Amazon ClickFix Campaign Abuses Windows Finger Command to Drop Lumma Stealer and NetSupport
Do Son 
The sponsored Google search result that led to a fake Amazon login page | Image: Huntress
| At a glance | |
| Malware family | Doina loader, a Node.js malware module, suspected Lumma Stealer, and a pirated NetSupport RMM client |
| Threat actor | Unknown; no attribution |
| Targets | Windows and macOS users searching for “amazon business”; at least three Huntress customers hit |
| Delivery vector | Sponsored Google ad leading to a fake Amazon login and a ClickFix fake CAPTCHA |
| Key capabilities | Credential and crypto wallet theft, remote access, fileless payload loading |
| Source | Huntress Labs, with context from Halcyon research on Doina |
TL;DR
A top sponsored Google result for “amazon business” led victims into an Amazon ClickFix campaign, according to Huntress. A fake CAPTCHA tricked users into running the decades-old Windows finger command. That single step kicked off a layered chain that dropped a stealer and a remote access tool.
Delivery
The attack began with a simple search. The top ad pointed to a lookalike subdomain on an attacker-controlled site. It then redirected users to a fake Amazon login page hosted on Google Sites.
After a victim entered an email or phone number, a fake CAPTCHA appeared. Clicking “I’m not a robot” copied a hidden command to the clipboard. Next, a pop-up told the user to paste it into the Windows Run box.
The command was hard to spot. Extra spaces and hyphens pushed the real text out of view. As a result, the Run box seemed to say only “Push the Enter key.” Mac users got a separate Terminal script, but its server was offline during Huntress’s research.
Google has since pulled the ad. However, Huntress says the attacker infrastructure “remains online and functional.”
Infection chain
Stage 1: The finger command
The pasted command launched finger.exe, a built-in network tool that predates the web. Decades ago, people used it to read short profile notes, called .plan files, on remote servers. Here, the attacker hid a Windows script inside a .plan file.
To bury the payload, the .plan file opened with 68 blank lines. The script then downloaded a legitimate IronPython package from GitHub and saved it with a fake .pdf extension. Finally, it used IronPython to fetch the next stage.
Notably, Huntress says finger has served as a ClickFix tool “for at least a year.” It sends plain text over port 79, yet few networks block it.
Stage 2: Doina loader
The next file was a Python script encoded in Base64. The authors swapped some Latin letters for Cyrillic ones to break simple decoding. Inside sat an XOR-protected loader that pulled down and decrypted another payload.
That payload is Doina, according to security vendor consensus. In 2024, Halcyon reported that Doina appeared as a step before ransomware attacks. Huntress adds that its modular design makes it useful as a general remote access tool and stealer.
Stage 3: Node.js and the stealer
Doina then downloaded a 52 MB archive with a portable Node.js runtime and an obfuscated script. That script fetched two encrypted files. The smaller one was a reflective loader. The larger one was “allegedly Lumma Stealer,” which the loader injected into memory through process hollowing.
Alongside this, the chain installed a pirated, eight-year-old copy of the NetSupport remote management tool in a hidden folder.
Command-and-control and data exfiltration
The suspected Lumma Stealer first sends the host name, user name, and other profile data to its server. Then it switches to a WebSocket connection for ongoing control. Through that channel, the server told the stealer which files to hunt for.
Targets included Chrome, Edge, Firefox, and Opera data. The stealer also sought Ledger, Electrum, and Atomic Wallet crypto wallets. In addition, it targeted LastPass, Dashlane, 1Password, NordPass, and RoboForm.
Meanwhile, NetSupport talked to its own server over a non-standard port. Payload archives changed once or twice per day, and each download had a unique hash. That design makes hash-based blocking harder.
A barbecue-themed network
Most domains in the Amazon ClickFix campaign sound like cooking magazines, with names built around grills and barbecue recipes. Huntress linked them through shared hosting, DNS, and payloads. Two non-food domains hosted the stealer packages.
Defense and detection guidance
Huntress notes that ClickFix made up about 2.2% of its EDR detections this year, yet nearly 99% of those were high severity. Key steps include:
- Teach users that no real CAPTCHA asks them to paste a command into Windows.
- Block outbound finger traffic on port 79 unless you truly need it.
- Alert when finger.exe, curl, or tar runs from a Run box or browser session.
- Watch for portable Python or Node.js runtimes appearing under ProgramData.
- Flag unknown NetSupport installs and traffic on unusual ports.
- Restrict access to the Windows Run dialog for users who never need it.
- Check browser and proxy logs for Google ad-click markers to trace malvertising paths.
In short, this Amazon ClickFix campaign turns a forgotten, decades-old tool into a modern delivery channel. As Huntress puts it, “An ounce of skepticism is worth hours of remediation.”
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
