Security researchers report that a ClickFix campaign is using malicious Google search results impersonating Amazon to trick Windows users into executing a CAPTCHA verification. Interaction triggers the legacy 'finger' utility, which facilitates the download and execution of Lumma stealer and other malware. The attack relies on search engine optimization manipulation to rank harmful results above legitimate Amazon pages.

What should defenders do?

Users should verify URLs before clicking, especially for Amazon-related searches. Be cautious of unexpected CAPTCHA prompts on search result pages. Ensure endpoint security solutions are active and updated. Use ad-blockers or search result filtering tools to reduce exposure to malicious SEO results. Organizations should educate users on the risks of interacting with unverified CAPTCHAs and search results.

highCyber Attacks

Decades-Old Windows Utility Exploited in Modern ClickFix Campaign Targeting Amazon Customers

Threat actors leverage the legacy 'finger' command and malicious SEO to deliver Lumma stealer via fake CAPTCHA prompts

Cyber.TechVoidPublished about 3 hours agoUpdated less than a minute ago1 min read

Decades-Old Windows Utility Exploited in Modern ClickFix Campaign Targeting Amazon Customers

Key Takeaways

ClickFix campaigns are evolving to abuse legacy Windows utilities like 'finger' for malware delivery.
Malicious SEO is being used to elevate fake Amazon pages in search results, leading to fake CAPTCHA prompts.
User interaction with the CAPTCHA triggers the 'finger' utility, which facilitates the execution of Lumma stealer.

Related Security News

highMalware

LiteLLM Release Pipeline Compromised to Distribute Info-Stealer Malware

The LiteLLM project's release pipeline was compromised, resulting in the publication of a malicious PyPI package and Docker images containing an info-stealer payload. The malware is designed to steal credentials, secrets, and environment variables from systems that pull the compromised artifacts.

BleepingComputerabout 1 hour ago1 min read

highCyber Attacks

Hackers Hid Vasilek Backdoor in VMware Tools During 2-Year Russian Healthcare Intrusion

A Belarus-aligned hacktivist group attributed to Partisan Zmiy (also known as Cyber Partisans) conducted a cyber espionage campaign against a Russian healthcare organization. According to a report by Russian cybersecurity firm Solar, the group hid the Vasilek backdoor in compromised VMware Tools installers, enabling nearly two years of unauthorized access beginning around October 2024 and discovered in October 2026. The attackers leveraged signed, seemingly legitimate software updates to maintain persistence and exfiltrate data.

The Hacker Newsabout 2 hours ago1 min read