Amazon-Themed ClickFix Campaign Serves Up Finger-Licking Malware

What it is

Huntress documents a ClickFix campaign that has hit at least three of its customers. It starts from a Google sponsored result for "amazon business" and ends with Doina, a Lumma Stealer payload and a pirated NetSupport RMM on the host. The unusual part is the lure command, which runs the Windows finger utility against an attacker-run server. The post says finger has been abused in ClickFix attacks for at least a year.

How it works

1. The sponsored result points to orders-amazon[.]com[.]advancedfences[.]com. That redirects to a fake Amazon login on sites.google[.]com/view/ch-pc/sign-in. After "submit", a fake CAPTCHA copies a command to the clipboard and tells the user to paste it into the Run box.
2. The command is obfuscated with commas, carets, hyphens and underscores. A suffix of spaces and hyphens makes the Run dialog look like it says "Push the Enter key". It runs finger DLVBUCeFfF@grillrecipespro[.]com, and the reply (the .plan file) is executed as a script. The script is pushed below the visible screen with 68 extra carriage returns. Finger uses plaintext 79/tcp.
3. The script uses curl to fetch IronPython 3.4.2 from GitHub. It saves the zip with a .pdf extension in Temp and unpacks it with tar. It then runs ipyw32.exe from the \net462 folder, passing a Base64, zlib-compressed Python blob on the command line. That blob fetches hxxp://grillmasterchef[.]com/90e4a147-1234-505c-a024-062e543b5df8/timer6.
4. timer6 is Base64 with some Latin letters swapped for Cyrillic ones, so a plain decode fails. Inside is a second Python layer with XOR-protected shellcode (19-byte key embedded as Base64). Huntress says it borrows from Veil's shellcode_inject/flat.py (same HeapCreate/HeapAlloc flags, buffer-copy pattern and native API sequence) but is not a stock Veil payload.
5. The shellcode is a PE loader. It looks on disk for an .ini file containing a URL, downloads from it, and RC4-decrypts the result. Here that was .../v6 on grillmasterchef[.]com, with the RC4 key in the first 64 bytes. The result is injected into memory and is, by vendor consensus, Doina. Halcyon reported in 2024 that Doina preceded ransomware attacks.
6. Doina downloads hxxps://kiriosyka[.]com/KsxmmKiN5N0j/sqr-viewertr6, a 52MB zip with portable Node.js and an obfuscated index.js. These go to C:\ProgramData\NodeView. index.js fetches two AES-256-GCM files (the first 12 bytes are the nonce, the next 16 the key). The small one (about 17KB) is an sRDI loader. The large one (over 19MB) is the stealer, allegedly Lumma, injected by process hollowing.
7. The stealer posts host profiling data over HTTPS, then switches to a websocket. Its target list covers browsers (Chrome, Edge, Firefox, Opera), wallets (Ledger, Electrum, Atomic Wallet), password managers (LastPass, Dashlane, 1Password, NordPass, RoboForm), email clients and PowerShell.
8. A pirated NetSupport RMM is also dropped in C:\ProgramData\Prodclear. It talks over 725/tcp to 167.148.201[.]106 and requests fakeurl.htm. Its license and signature are at least eight years old.

The same Google Sites page serves macOS visitors a Terminal command instead. Its URL, hxxp[://]ashevilleroofingcontractor[.]com/curl/..., was offline during the research.

What to do

Indicators from the page:

• Stealer C2: perfectgrillrecipes[.]com for check-in, thegrilljournal[.]com and homelygrill[.]com for exfil.
• Payload hosts: liokida[.]com, kiriosyka[.]com.
• Other themed domains: grillrecipespro, grillmasterchef, embersandbites.
• RMM C2: 167.148.201[.]106 on 725/tcp. The IP also hosts a legitimate Detroit restaurant site.
• Update pull: the Node component can request the same payload URL with ?exclude_bins=true for a roughly 20MB archive without Node.
• Huntress has published the full IOC list on its GitHub.

Detection and blocking ideas the page gives:

• Look for outbound 79/tcp, since few networks use finger legitimately.
• Look for ipyw32.exe running, a .pdf-named zip in Temp, or node.exe under C:\ProgramData\NodeView.
• Search browser history, proxy logs or URL telemetry for aclk in the path and gclid in query strings to trace a visit back to a Google ad. Report the ads to Google.
• Disable the Run dialog for users who do not need it. Huntress offers this as "Attack Reduction" in Managed ESPM Early Access.
• Train users that no CAPTCHA asks them to paste a command.

Caveats

• Blocking the Run dialog does not stop ClickFix variants that ask users to open PowerShell, the command prompt or the Explorer address bar.
• Attribution of the final payload to Lumma is hedged ("allegedly"). The Doina identification rests on vendor consensus.
• The stealer payload changed once or twice a day, and each download has a unique hash because the server appends random null bytes, so hash-based detection is weak.
• The post gives no mitigation for the macOS variant, which was offline when tested.