Amazon-Themed ClickFix Campaign Serves Up Finger-Licking Malware
Huntress, Wednesday, October 21st, 2026
Huntress details an Amazon-themed ClickFix campaign using the finger utility to deliver Lumma Stealer and NetSupport.
Huntress investigated incidents from an Amazon-themed ClickFix campaign that used a sponsored Google result for amazon business to lead victims to a spoofed login page.
After a fake CAPTCHA, victims pasted a disguised command into the Windows Run dialog that used the built-in finger utility to fetch a hidden script.
The multi-stage chain used obfuscated loaders, the Doina modular malware and a Node.js package to deliver Lumma Stealer and a pirated NetSupport Client.
Huntress notes the barbecue-themed infrastructure stayed online after Google pulled the ad and recommends user awareness and restricting Run dialog access.