Windows ClickFix Abuses Finger to Deploy Lumma Stealer and Doina

EXECUTIVE SUMMARY:

The threat is distributed through paid search results that redirect users to a spoofed login page for a major e-commerce brand. The interface mimics a standard verification process, presenting a fake challenge that instructs victims to execute a command in their operating system terminal. This social engineering technique, known as ClickFix, relies on user trust in legitimate brands and the unfamiliarity of the specific command syntax. The attack targets both Windows and macOS environments, though the detailed analysis focuses on the Windows execution path. The initial access vector is unknown beyond the sponsored ad click, but the subsequent infection is severe, leading to the deployment of multiple distinct malware families including infostealers and remote access tools. The risk is high because the method bypasses traditional perimeter defenses by relying on user action.

The execution chain begins with a command that leverages the finger utility to retrieve a script from a remote user account. This script downloads a Python interpreter, which then executes a heavily obfuscated payload. The payload uses character substitution and encryption to hide its logic before injecting shellcode into memory. This shellcode acts as a loader, downloading and decrypting a remote access tool that establishes a persistent presence. The malware then deploys a portable Node.js environment to a hidden directory, where it runs a malicious script. This script decrypts and injects an infostealer into memory using process hollowing. The infostealer communicates over websockets to exfiltrate data from browsers, password managers, and cryptocurrency wallets. Additionally, a pirated remote management tool is installed to maintain access, communicating over a non-standard port to a specific server address. The entire process is designed to evade detection by using fileless techniques and legitimate system utilities.[emaillocker id="1283"]

The campaign has impacted multiple organizations, indicating a targeted effort rather than a mass, indiscriminate attack. The use of themed infrastructure and modular malware components suggests an active development cycle aimed at maximizing the value of compromised endpoints. The deployment of multiple malware types allows the actor to adapt to different objectives, from data theft to further lateral movement. Defenders should focus on user awareness training to recognize social engineering prompts and monitor for unusual network traffic on legacy ports. Additionally, restricting access to command-line interfaces for standard users can mitigate the risk of similar social engineering attacks. The presence of pirated software in the infection chain highlights the need for software inventory management to detect unauthorized tools.

THREAT PROFILE:

MBC MAPPING:

REFERENCES:

The following reports contain further technical details:

• https://www.huntress.com/blog/amazon-clickfix-finger