Fake Amazon ads use Windows Finger to deliver data stealing malware

Huntress, with Halcyon context, traces the Amazon ClickFix campaign to a sponsored Google search result for “amazon business” that redirected victims to a fake Amazon login page and a ClickFix CAPTCHA. Victims who clicked “I’m not a robot” copied a hidden command to the clipboard, which was then pasted into the Windows Run box. In Mac environments, a separate Terminal script was served, but the server was offline during research.

Google has removed the ad, but Huntress notes the attacker infrastructure remains online and functional. The attack chain begins with the Windows finger command, a decades‑old tool, which is exploited to load the subsequent payloads.

In Stage 1, finger.exe launches a Windows script concealed inside a .plan file opened with 68 blank lines. It downloads a legitimate IronPython package from GitHub, disguising it as a PDF, and uses IronPython to fetch the next payload. Stage 2 delivers a Python script encoded in Base64 with Cyrillic‑mixing to defeat simple decoding; it contains an XOR‑protected loader that retrieves another payload.

The payload is Doina, described by researchers as a modular tool capable of remote access and data theft, previously observed as a step before ransomware. Stage 3 brings a 52 MB Node.js runtime archive and an obfuscated script that retrieves two encrypted files: a reflective loader and an alleged Lumma Stealer, which is injected into memory via process hollowing. The chain also includes a pirated eight‑year‑old copy of NetSupport RAT installed covertly.

Doina then communicates with its C2 over a WebSocket, instructing the stealer which files to target, including crypto wallets and password managers. The campaign reportedly used multiple domains with malvertising mechanics that Huntress linked through shared hosting and payloads, with most domains resembling cooking sites.