ClickFix Attack Uses Windows Finger Utility to Install Lumma Stealer via Search

Cybercriminals are executing a campaign known as ClickFix that utilizes a decades-old Windows utility to install malware on user devices. According to a report by Dark Reading, the attack chain relies on malicious Google search results to trick users into triggering the malicious payload.

The operation specifically leverages the 'finger' utility, a legacy tool included in Windows, to facilitate the installation of the Lumma stealer. Instead of introducing new executable files directly, the attackers use this existing utility to launch a CAPTCHA mechanism. This CAPTCHA serves as the vector that ultimately installs the malware on the compromised system.

Attack Mechanics and Vectors

The ClickFix campaign depends on users interacting with deceptive content found in search engine results. Dark Reading reported that the attackers place malicious links in Google search results that appear relevant to Amazon-related queries. Users searching for Amazon services or products may encounter these fraudulent entries.

When a user clicks on the malicious result, the 'finger' utility is activated. This utility, which has been part of Windows for decades, is repurposed to execute the next stage of the attack. The utility launches a CAPTCHA interface, which acts as the delivery mechanism for the Lumma stealer. This stealer is designed to harvest sensitive data from the infected machine.

Targeting Strategy

The choice of Amazon-related keywords indicates a specific targeting strategy aimed at users searching for e-commerce or cloud services. Dark Reading noted that the malicious search results are tied to Amazon, suggesting the attackers are capitalizing on the high volume of traffic associated with this brand.

By embedding their malicious links among legitimate search results, the attackers increase the likelihood of user interaction. The use of a trusted brand name like Amazon helps to lower user suspicion. Once the user engages with the result, the automated process triggered by the 'finger' utility proceeds without further user input beyond the initial click.

What should you do?

Security teams should monitor for unexpected executions of the 'finger' utility on Windows endpoints. This utility is rarely used in modern environments, so its activation can be an indicator of compromise. Additionally, organizations should review search engine safety settings and educate users about the risks of clicking on unfamiliar search results, even if they appear to be from well-known brands.

What to do and how to stay safe: Windows

• Monitor endpoint logs for the execution of the 'finger' utility, as this is rare in current enterprise environments.
• Inspect browser history and search logs for interactions with unexpected Amazon-related links that lead to CAPTCHA pages.
• Deploy application control policies to restrict the execution of legacy utilities that are not required for daily operations.
• Review installed software for the presence of the Lumma stealer or other unknown processes launched by system utilities.

Step-by-step guide: Social Engineering Warning Signs and How to Respond

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

How does the ClickFix attack install malware?

The attack uses the Windows 'finger' utility to launch a CAPTCHA that installs the Lumma stealer on the victim's device.

What search terms are targeted in this campaign?

The attack leverages malicious Google search results related to Amazon to lure victims.

Is the finger utility considered deprecated?

The source material describes the 'finger' utility as a decades-old Windows tool, but does not state it is deprecated.