Amazon-Themed ClickFix Campaign Abuses Windows Utility to Deliver Malware

Executive Summary

A newly reported ClickFix campaign is exploiting trust in Amazon and legitimate Windows utilities to trick users into installing malware. The attack begins with sponsored search results associated with Amazon Business, which redirect victims to a fraudulent Amazon login page. After entering their details, users encounter a fake CAPTCHA verification prompt that instructs them to perform actions that ultimately triggers malicious command execution.  

The campaign abuses the legitimate Windows finger.exe utility to retrieve attacker-controlled instructions and initiate a multi-stage infection chain. Reported payloads include Lumma Stealer, which can steal sensitive information, and an unauthorized NetSupport Client installation that can provide remote access to the compromised device. Additional components, including IronPython and obfuscated loaders, complicate detection and investigation.  

The key risk is that the attack relies on user manipulation and trusted system utilities rather than conventional software vulnerability. This means a user can initiate the infection themselves, potentially bypassing controls that focus primarily on suspicious downloads or known malware files. Organizations should prioritise detecting unusual command execution, monitoring unexpected use of finger.exe, and educating users that legitimate CAPTCHA challenges never require them to execute commands on their devices.

Business Impact

• Credential and information theft: Lumma Stealer can expose saved credentials, browser information and other sensitive data, potentially enabling account takeover and further compromise.

• Unauthorised remote access: The deployment of a hidden NetSupport Client may allow attackers to remotely interact with compromised systems.

• Wider network compromise: Stolen credentials and remote access can provide opportunities for further intrusion into corporate systems and cloud services.

• Security monitoring gaps: The use of legitimate Windows utilities and obfuscated commands may evade detections that focus on conventional malware files.

• Operational and financial consequences: Compromised devices may require isolation, forensic investigation, credential resets and recovery activities, disrupting users and business operations.

What to Look Out For

• Fake Amazon pages and CAPTCHA prompts: Fraudulent login pages, sponsored search results and verification instructions that ask users to copy and execute commands.

• Suspicious finger.exe activity: Unexpected execution of the Windows utility, particularly outbound connections over TCP/79 to unfamiliar external hosts.

• Unusual command execution: Obfuscated commands, hidden command windows, unexpected process chains initiated by explorer.exe, or suspicious use of cmd.exe and other scripting tools.

• Unexpected software and payloads: Unauthorised IronPython installations, Lumma Stealer indicators, or hidden NetSupport Client installations.

• Suspicious network connections: Connections to unfamiliar domains, unexpected TCP/79 traffic and non-standard ports such as TCP/725.

• Persistence and staging activity: Unexpected files or directories under C:\ProgramData, suspicious scheduled tasks, and unauthorised remote-management activity.

Recommendations

• Strengthen user awareness: Advise users never to paste commands into Windows Run, Command Prompt or PowerShell to complete a CAPTCHA, verify their identity or resolve a browser error.

• Restrict unnecessary utilities: Assess whether finger.exe and other rarely used utilities are required. Restrict their use where technically feasible and monitor unexpected execution.

• Contain affected endpoints: Isolate suspected compromised devices, investigate potential credential theft, revoke affected sessions and reset compromised credentials where warranted.

Conclusion

This campaign demonstrates how attackers can turn familiar brands, fake verification prompts and legitimate Windows utilities into an effective malware delivery mechanism. The use of finger.exe to retrieve attacker-controlled instructions highlights the limitations of relying solely on traditional malware signatures or download-based detections.

‍