HUNTRESS researchers have identified a ClickFix campaign that uses fake Amazon login pages to trick people into running malware. The attack begins with a sponsored Google result for “amazon business”, hosted on a suspicious domain and redirecting to a counterfeit login page on Google Sites. After a visitor enters an email address or phone number, the page displays a fake CAPTCHA.
Researchers say interacting with it triggers Windows’ built-in `finger` utility, which retrieves attacker-controlled instructions from a remote `.plan` file.
The command starts a multi-stage chain involving IronPython and several obfuscated loaders, ultimately installing multiple payloads. These include a version of Lumma Stealer and a pirated copy of the NetSupport Client remote monitoring and management tool. Huntress says the use of `finger.exe` distinguishes this campaign from simpler ClickFix attacks and may help it evade notice: the utility uses TCP port 79, which some firewalls, network filters and data-loss prevention tools may overlook.
The researchers describe the chain as modular and designed to make investigation harder; the article does not report confirmed victim numbers or independently establish that every payload was successfully installed.
Google has removed the malicious advertisement, but Huntress says the attacker infrastructure remains online and functional. The researchers recommend monitoring or blocking outbound TCP/79, alerting on unexpected `finger.exe` activity, and looking for unusual staging in `C:\ProgramData` and hidden NetSupport activity, including on non-standard TCP/725.
They also advise restricting the Windows Run dialog where possible and reminding users that legitimate CAPTCHAs do not ask them to paste commands into Run, PowerShell or Command Prompt.