Fake Amazon ads on Google spread Lumma via Windows finger tool
Huntress researchers say a ClickFix campaign lured searchers for Amazon Business to fake login pages, ending in Lumma and NetSupport payloads.
Security researchers have identified a ClickFix campaign that abuses the Windows built-in “finger” network utility to deliver information-stealing malware, according to dailysecu.com. The attack chain ran through malicious Google ads and fake Amazon login pages.
Users searching for “Amazon Business” were steered to malicious sponsored results that opened a fake Amazon login page built with Google Sites. After entering an email address or phone number, they were shown a fake human-verification screen that instructed them to run commands manually.
The commands launched finger.exe, which retrieved data from a server controlled by the attackers. The chain then used IronPython and several stages of obfuscated execution tools, with a final payload that included a suspected Lumma infostealer and NetSupport remote-control software.
According to the researchers at Huntress, Google removed the malicious ads after being notified, but the attack infrastructure was still active at the time of analysis. The researchers said the confirmed cases are not enough to establish the overall scale of infection or domestic damage.
Why the built-in utility matters
Finger is a legitimate Windows networking command, and the campaign relied on users copying and running commands themselves rather than on a software flaw. That approach is central to ClickFix, which turns a verification prompt into the delivery step.
Quick answers
What is the finger utility used in this campaign?
Finger (finger.exe) is a built-in Windows network command. In this campaign it was used to retrieve data from an attacker-controlled server after victims ran commands from a fake verification page.
What malware was delivered?
The final payload included a suspected Lumma infostealer and NetSupport remote-control software, reached through IronPython and multiple obfuscated stages.
Are the malicious ads still up?
Researchers said Google removed the malicious ads, but the attack infrastructure was still active at the time of analysis.