/
← Voltar ao feed
high

Amazon-themed ClickFix malvertising abuses finger.exe to deliver Doina, Lumma Stealer and NetSupport RAT

2 fonte(s) · 2 atualização(ões) · publicado 21/10/2026 10:00 · coletado há 1 hora

Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 21/10/2026 12:17; os links antigos trazem para cá.

Fontes: huntress.com ↗ darkreading.com ↗

A ClickFix malvertising campaign uses sponsored Google results for "amazon business" to lure victims to a fake Amazon login page on Google Sites and then to a fake CAPTCHA. The CAPTCHA pastejacks a command into the clipboard that the victim is told to run in the Windows Run box. The command abuses the legacy finger.exe utility to fetch a script from a .plan file on attacker infrastructure (huntress.com). The multi-stage chain installs Doina, a loader that delivers Lumma Stealer, plus a pirated NetSupport RMM (huntress.com). Huntress reports at least three affected customers; darkreading.com independently describes the same activity and notes that using a rarely monitored built-in utility may help evade detection. The campaign is cross-platform, with alternate instructions served to macOS users, and its infrastructure uses barbecue-themed domains (huntress.com). No attribution has been given.

Timeline

  • 2026-10-21 13:00 UTC: Huntress publishes its investigation of the campaign (huntress.com).
  • 2026-10-21 13:00 UTC: Dark Reading publishes a summary of the finger-based ClickFix chain delivering Lumma stealer (darkreading.com).

Technical Details

  • Lure: The sponsored ad pointed to orders-amazon[.]com[.]advancedfences[.]com, which redirected to sites.google[.]com/view/ch-pc/sign-in. After the victim submitted an email or phone number, a fake "I'm not a robot" CAPTCHA copied the command to the clipboard. The command is padded with spaces and hyphens so the Run dialog appears to say only "Push the Enter key", and it is obfuscated with caret, comma, hyphen and underscore characters (huntress.com).
  • Stage 1 (finger): finger DLVBUCeFfF@grillrecipespro[.]com retrieves a .plan file over port 79/tcp. The script is hidden below 68 extra carriage returns. It uses curl to download IronPython 3.4.2 from GitHub, saves it in Temp with a .pdf extension, unpacks it with tar, then runs ipyw32.exe with a Base64/zlib-encoded Python blob (huntress.com).
  • Stage 2: The blob fetches grillmasterchef[.]com/.../timer6, a Python script encoded in Base64 with Cyrillic letter substitution. It borrows from Veil's shellcode_inject/flat.py and holds a second layer XOR-encrypted with a 19-byte key. The decoded layer is a PE loader that finds an .ini file containing a URL, downloads /v6 and RC4-decrypts it (key in the first 64 bytes). The result is injected into memory and is assessed by vendors to be Doina (huntress.com).
  • Stage 3: Doina downloads sqr-viewertr6 from kiriosyka[.]com, a 52MB archive with a portable Node.js and a malicious index.js, unpacked to C:\ProgramData\NodeView. index.js decrypts two files with AES-256-GCM: a smaller sRDI loader that injects the larger one, allegedly Lumma Stealer, via process hollowing (huntress.com).
  • Lumma behavior: It beacons over HTTPS POST, then WebSocket. It targets browsers, crypto wallets (Ledger, Electrum, Atomic Wallet), password managers and PowerShell. Check-in goes to perfectgrillrecipes[.]com and exfiltration to thegrilljournal[.]com and homelygrill[.]com. Payloads rotate once or twice per day, and the server appends random null bytes so each archive has a unique hash (huntress.com).
  • Remote access: A pirated, eight-year-old NetSupport Client is deployed to C:\ProgramData\Prodclear and communicates over 725/tcp with 167.148.201[.]106 (fakeurl.htm). The source text is truncated after noting this IP otherwise hosts a legitimate service (huntress.com).

Remediation

  • Neither source provides official remediation. Dark Reading suggests defenders consider monitoring and restricting use of the finger utility, and training users to distrust CAPTCHA pages that ask them to run commands (darkreading.com).
  • Based on the technical details, defenders can also consider blocking outbound 79/tcp and 725/tcp and hunting for the listed domains and file paths (derived from huntress.com).

Linha do tempo

  1. huntress.com ↗ · pub. 21/10/2026 10:00 · coletado 21/10 12:01

    Amazon-themed ClickFix malvertising campaign abuses finger.exe to deliver Doina, Lumma Stealer and NetSupport RAT

    ler a análise desta fonte

    Huntress investigated a malvertising-driven ClickFix campaign that has hit at least three customers. A sponsored Google result for "amazon business" led victims to a fake Amazon login page on Google Sites and then to a fake CAPTCHA. The CAPTCHA pastejacks a command into the clipboard and tells the victim to run it in the Windows Run box. The command abuses the legacy finger.exe LOLbin to pull a script from a .plan file on attacker-controlled infrastructure. The resulting multi-stage chain installs Doina, a Node.js-based loader delivering Lumma Stealer, and a pirated NetSupport RMM. The campaign is cross-platform, with alternate instructions served to macOS users, and its infrastructure uses barbecue-themed domains.

    Technical Details

    • Lure: The sponsored ad pointed to orders-amazon[.]com[.]advancedfences[.]com, which redirected to sites.google[.]com/view/ch-pc/sign-in. After the victim submitted an email or phone number, a fake "I'm not a robot" CAPTCHA copied the command to the clipboard. The command line is padded with spaces and hyphens so the Run dialog appears to say only "Push the Enter key". Caret, comma, hyphen and underscore characters obfuscate it.
    • Stage 1 (finger): finger DLVBUCeFfF@grillrecipespro[.]com retrieves a .plan file over port 79/tcp. The script is hidden below 68 extra carriage returns. It uses curl to download IronPython 3.4.2 from GitHub, saves it in Temp with a .pdf extension, and unpacks it with tar. It then runs ipyw32.exe with a Base64/zlib-encoded Python blob.
    • Stage 2: The blob fetches grillmasterchef[.]com/.../timer6, a Python script encoded in Base64 with Cyrillic letter substitution. It borrows from Veil's shellcode_inject/flat.py and contains a second layer XOR-encrypted with a 19-byte key. The decoded layer is a PE loader that finds an .ini file containing a URL, downloads /v6 and RC4-decrypts it (key in the first 64 bytes). The result is injected into memory and is assessed by vendors to be Doina.
    • Stage 3: Doina downloads sqr-viewertr6 from kiriosyka[.]com, a 52MB archive with a portable Node.js and a malicious index.js, unpacked to C:\ProgramData\NodeView. index.js decrypts two files with AES-256-GCM. The smaller is an sRDI loader, which injects the larger one, allegedly Lumma Stealer, via process hollowing. The stealer beacons over HTTPS POST, then WebSocket. It targets browsers, crypto wallets (Ledger, Electrum, Atomic Wallet), password managers and PowerShell. Exfiltration goes to thegrilljournal[.]com and homelygrill[.]com after check-in to perfectgrillrecipes[.]com. Payloads rotate once or twice per day, and the server appends random null bytes so every archive has a unique hash.
    • Persistence and remote access: A pirated, eight-year-old NetSupport Client is deployed to C:\ProgramData\Prodclear. It communicates over 725/tcp with 167.148.201[.]106 (fakeurl.htm), an IP that otherwise hosts a legitimate Detroit restaurant site.
    • Detection: Google ad-click markers aclk and gclid (also gadsource, gadcampaignid, gbraid) in proxy or browser history help reconstruct the ad-to-malware chain. Outbound port 79/tcp traffic and 725/tcp NetSupport traffic are also indicators.

    Remediation

    • Train users that no legitimate CAPTCHA asks them to paste a command into Run, a terminal or PowerShell.
    • Block outbound finger (port 79/tcp) and monitor for finger.exe execution.
    • Restrict access to the Windows Run dialog where it is not needed. Huntress cites its Attack Reduction feature for this.
    • Hunt for aclk/gclid ad-click chains, the listed domains and hashes, C:\ProgramData\NodeView and Prodclear, and 725/tcp NetSupport traffic.
    • Report malicious ads to Google.
  2. darkreading.com ↗ · pub. 21/10/2026 10:00 · coletado 21/10 12:00 primeiro registro só resumo do feed

    ClickFix campaign abuses Windows 'finger' utility via malicious Amazon-themed Google results to deliver Lumma stealer

    ler a análise desta fonte

    A ClickFix campaign uses malicious Google search results themed around Amazon to lure victims to a fake CAPTCHA page. The attack abuses the decades-old Windows finger utility to launch the infection chain, which installs malware including the Lumma stealer. Using a legacy, rarely monitored built-in utility may help the activity evade detection that focuses on more commonly abused tools. The article snippet gives no attribution, victim counts or indicators.

    Technical Details

    • Initial access is through poisoned Google search results related to Amazon.
    • Victims are shown a fake CAPTCHA, the usual ClickFix social-engineering lure.
    • The native Windows finger utility is used to launch the chain and retrieve the malware.
    • The final payloads include the Lumma stealer.

    Remediation

    The article snippet does not provide remediation guidance. Defenders can consider monitoring for and restricting use of the finger utility, and training users to distrust CAPTCHA pages that ask them to run commands.