Huntress Says Sponsored Amazon Business Search Ads Led to ClickFix Lures That Abuse the Decades-Old Finger Command to Install Lumma Stealer and a Pirated Copy of NetSupport

LONDON - A search for "amazon business" on Google was enough to start the chain. Huntress said on Wednesday that the top sponsored result for that phrase led victims to a fake Amazon sign-in page, then to a fake CAPTCHA that talked them into running a command that ended with an information stealer and a pirated remote access tool on their machines.

The security company said the method has already struck at least three of its customers. Google has removed the malicious ad, Huntress researchers Andrew Brandt and Sarah Reddish wrote, but the attacker infrastructure remains online and functional.

From a sponsored ad to the Run dialog

The ad pointed to a subdomain of an attacker-controlled domain, orders-amazon[.]com[.]advancedfences[.]com, which redirected to a fake Amazon login hosted on Google Sites. After a visitor entered an email address or phone number, the page displayed a fake CAPTCHA. Clicking "I'm not a robot" copied a command to the clipboard and told the user to paste it into the Windows Run box. Visitors on macOS were given a different script to run in Terminal, though that payload address was offline when Huntress examined it.

The command was padded with trailing spaces and hyphens so that the Run dialog appeared to say only "Push the Enter key," Huntress said, and its characters were broken up with commas, carets, hyphens and underscores that the Windows command interpreter ignores.

Finger, a relic, as the first stage

The command calls finger.exe, a network utility that predates the web, to query a user account on grillrecipespro[.]com. The attacker stored a Windows script in that account's .plan file and pushed it below the visible screen with 68 extra carriage returns. Finger traffic travels in plaintext over port 79/tcp by default, Huntress noted, which should make it easy to detect or block, "but since nobody uses finger anymore, most networks don't block this content."

The script uses curl to download a legitimate IronPython 3.4.2 archive from GitHub, saves it in the user's Temp folder with a .pdf extension, unpacks it with tar and passes an encoded Python blob to the ipyw32.exe interpreter. That stage retrieves a script called timer6 from grillmasterchef[.]com, whose Base64 has some Latin letters swapped for Cyrillic ones, and which decodes through a 19-byte XOR key into a Windows loader. The loader pulls and RC4-decrypts a payload that security vendors identify as Doina, a modular loader and remote access tool.

Doina then downloaded a 52 MB archive from kiriosyka[.]com containing a portable Node.js runtime and an obfuscated index.js, unpacked to C:\ProgramData\NodeView. The Node component decrypted two more files with AES-256-GCM: a shellcode reflective DLL injector and a stealer that Huntress said is allegedly Lumma Stealer, which was injected through process hollowing and beaconed over WebSockets. Its targets included browsers, cryptocurrency wallets, password managers and email clients.

A pirated RMM on an odd port

The chain also installed a pirated copy of the NetSupport Client remote management tool in a nonstandard folder, C:\ProgramData\Prodclear, with a license that Huntress said is at least eight years old. It communicated over port 725/tcp with 167.148.201[.]106, an address that otherwise hosts a Detroit restaurant's website, requesting a file named fakeurl.htm.

Most of the command servers carry barbecue names: grillrecipespro, thegrilljournal, embersandbites, grillmasterchef, homelygrill and perfectgrillrecipes. Huntress said ClickFix accounted for about 2.2 percent of the detection signals from its managed endpoint detection and response service so far this year, but nearly 99 percent of those detections were high severity. "No legitimate CAPTCHA should ever ask anyone to paste an arbitrary line of text into an operating system command prompt," the researchers wrote.

What detection teams should hunt

• Any execution of finger.exe on Windows endpoints, and any outbound traffic to port 79/tcp, which most networks can block outright.
• Run dialog (explorer.exe) launches of cmd.exe whose command lines contain caret, comma or underscore padding, or long runs of trailing spaces.
• curl downloading IronPython archives, files with a .pdf extension unpacked by tar in Temp, and ipyw32.exe started with a long encoded argument.
• node.exe running from C:\ProgramData\NodeView, and a NetSupport client32.exe from C:\ProgramData\Prodclear or any unapproved path.
• HTTP or HTTPS traffic on port 725/tcp, requests for fakeurl.htm and connections to 167.148.201[.]106.
• DNS and proxy hits on advancedfences[.]com, grillrecipespro[.]com, grillmasterchef[.]com, thegrilljournal[.]com, homelygrill[.]com, perfectgrillrecipes[.]com, embersandbites[.]com, kiriosyka[.]com and liokida[.]com.
• Browser history and proxy logs showing the Google ad-click markers aclk and gclid immediately before a visit to a lookalike login page, which Huntress said can reconstruct the ad-to-malware path.

Huntress also suggested restricting access to the Windows Run dialog for the many users who never need it, while noting that attackers sometimes direct victims to PowerShell, the command prompt or the File Explorer address bar instead.