Threat actors are using an Amazon-themed Google search result and the decades-old Windows finger.exe utility to turn a fake CAPTCHA into a malware delivery mechanism, in a fresh variation of the ClickFix social-engineering technique. The campaign reportedly delivered Lumma Stealer and NetSupport Client, putting browser credentials, session cookies and potentially corporate access at risk.
The attack begins with search-engine poisoning designed to attract people looking for legitimate Amazon business information. Visitors who reach the attacker-controlled page are shown a CAPTCHA or human-verification prompt and told to run a command locally. Rather than exploiting a browser flaw, the page persuades the victim to copy attacker-supplied instructions and execute them through Windows tools—a pattern Microsoft identifies as Behavior:Win32/ClickFix.
In this iteration, the command invokes finger.exe, a legitimate Microsoft utility originally intended to retrieve user information from a remote computer running the Finger service. Microsoft’s documentation describes the tool’s normal use and its remote-host syntax at Microsoft Learn. Attackers can repurpose its text-based network exchange to retrieve encoded content from infrastructure they control, then chain that content into additional commands and payloads.
The use of a signed, preinstalled utility can complicate detection because the initial activity resembles ordinary system administration rather than a conventional malware download. However, the decisive step remains the victim’s execution of the command. Security researchers have previously documented finger.exe being abused through fake CAPTCHA pages as a living-off-the-land delivery channel, including campaigns that used the Finger protocol’s TCP port 79 to return encoded scripts.
Lumma is an information stealer capable of targeting saved browser passwords, cookies, autofill data and cryptocurrency-wallet material; Microsoft has also observed ClickFix chains using fake CAPTCHA pages and commands launched through the Windows Run dialog. NetSupport Client is a legitimate remote-management product, but its unauthorized deployment can give attackers interactive access and a foothold for follow-on activity. There is no verified CVE associated with this incident, and no Windows security patch addresses the core technique: the campaign abuses normal functionality and user interaction rather than a newly disclosed software vulnerability.
Organizations should treat any web page that asks users to press Win+R, open PowerShell or Terminal, paste clipboard content, or execute finger.exe as suspicious. Administrators can hunt for unusual outbound connections from finger.exe, encoded command activity, unexpected NetSupport installations and browser-session theft, while endpoint controls should restrict script interpreters and alert on command execution from browsers. Anyone who followed the prompt should isolate the device, reset credentials from a known-clean system, revoke active sessions and investigate stored browser secrets.
