finger.exe Is Back: How a 1970s Windows Utility Is Fueling 2026's Most Dangerous ClickFix Attacks
Executive Summary
In October 2026, researchers at Huntress uncovered a sophisticated ClickFix campaign exploiting malicious Google-sponsored search results targeting the keyword 'amazon business.' Victims were redirected to a spoofed Amazon login page hosted on Google Sites, where a fake CAPTCHA invoked Windows' legacy finger.exe utility — a LOLBIN dating to the 1970s — to silently retrieve and execute a remote .plan file. This initiated a multi-stage infection chain installing IronPython, obfuscated loaders, a Lumma Stealer infostealer, and a pirated NetSupport RMM client, enabling credential theft and persistent remote access across compromised endpoints.
This incident signals a maturation of ClickFix as an attack framework, evolving from a simple social-engineering trick into a modular, multi-payload delivery mechanism. The abuse of obscure but pre-installed Windows binaries like finger.exe — which routes traffic over TCP/79, a port largely ignored by firewalls and DLP tools — highlights how attackers continue to weaponize trusted system utilities to bypass modern defenses and evade detection.
Why This Matters Now
ClickFix attacks accounted for nearly 2.2% of all Huntress Managed EDR detections in 2026, with 99% rated high severity. As attackers pair trusted brands, sponsored ads, and built-in LOLBINs like finger.exe into modular chains deploying infostealers and RMM tools, organizations relying on perimeter-only or signature-based defenses face significant blind spots — particularly for outbound traffic on obscure, unmonitored ports like TCP/79.
Attack Path Analysis
Attackers placed a malicious sponsored Google ad targeting 'amazon business' searches, redirecting victims to a spoofed Amazon login page hosted on Google Sites that embedded a ClickFix fake CAPTCHA, which triggered the legacy Windows finger.exe utility to retrieve a remote .plan file and initiate a multi-stage payload chain. The chain installed IronPython, obfuscated loaders, the Lumma Stealer infostealer, and a hidden NetSupport RMM client, ultimately enabling credential theft, persistent remote access, and potential data exfiltration from compromised endpoints.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
Victims clicked a malicious sponsored Google search result for 'amazon business' that redirected to a fake Amazon login page hosted on Google Sites. The page presented a ClickFix-style fake CAPTCHA challenge that socially engineered users into opening the Windows Run dialog and pasting a malicious finger.exe command. The finger utility, operating over TCP/79, retrieved a remote .plan file from attacker-controlled infrastructure (orders-amazon[.]com[.]advancedfences[.]com), initiating the attack chain without triggering common endpoint defenses or proxy-aware filters.
MITRE ATT&CK® Techniques
Phishing: Spearphishing Link
User Execution: Malicious Link
System Binary Proxy Execution
Command and Scripting Interpreter: PowerShell
Obfuscated Files or Information
Credentials from Password Stores
Remote Access Software
Acquire Infrastructure: Domains
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
NIST SP 800-53 Rev. 5 – Malicious Code Protection
Control ID: SI-3
PCI DSS 4.0 – Anti-Malware Mechanisms
Control ID: Requirement 5.2
NYDFS 23 NYCRR 500 – Monitoring and Training
Control ID: Section 500.14
NIS2 Directive – Incident Handling and Detection
Control ID: Article 21(2)(b)
CISA Zero Trust Maturity Model 2.0 – Network Traffic Filtering and Segmentation
Control ID: Network Pillar – Micro-Segmentation
ISO/IEC 27001:2022 – Filtering of Web Services and Application Whitelisting
Control ID: Annex A 8.22
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Financial Services
ClickFix-delivered Lumma Stealer targets financial credentials via spoofed Amazon login pages, with egress exfiltration paths and lateral movement risks threatening PCI 4.0 and NIST.800-53 compliance postures.
Retail Industry
Malicious sponsored ads impersonating Amazon Business directly expose retail sector employees to infostealer compromise, with unmonitored finger.exe traffic bypassing DLP and egress policy enforcement controls.
Information Technology/IT
LOLBIN abuse via finger.exe and modular NetSupport RMM payloads evade endpoint detection, demanding Zero Trust segmentation and multicloud visibility to contain lateral movement and command-and-control exfiltration.
Computer/Network Security
ClickFix evolution into multilayered LOLBIN delivery chains challenges security operations teams, requiring inline IPS signature updates, egress TCP/79 blocking, and anomaly detection baselining per NIST.CSF.DE.CM-4 controls.
Sources
- Decades-Old Windows Utility Powers Modern ClickFix Attackhttps://www.darkreading.com/cyberattacks-data-breaches/decades-old-windows-utility-modern-clickfix-attackVerified
- Huntress Threat Report: ClickFix and LOLBIN Abuse via finger.exehttps://www.huntress.com/blogVerified
- MITRE ATT&CK: Living Off the Land Binaries (LOLBIN) - T1218https://attack.mitre.org/techniques/T1218/Verified
- CISA: Phishing and Social Engineering Guidancehttps://www.cisa.gov/topics/cyber-threats-and-advisories/malware-phishingVerified
- Lumma Stealer Malware Family Overview - MITRE ATT&CK S1184https://attack.mitre.org/software/S1184/Verified
- NetSupport Manager Abused as Remote Access Tool in Malware Campaignshttps://www.cisa.gov/news-events/cybersecurity-advisoriesVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
This incident exploited endpoint-level phishing, legacy protocol abuse, and outbound C2 channels that Aviatrix Zero Trust CNSF can address through workload segmentation and controlled egress enforcement. By constraining lateral reachability and restricting outbound paths to attacker-controlled infrastructure, CNSF would likely reduce the blast radius available to the attacker following initial endpoint compromise.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Egress traffic over nonstandard or legacy protocols like TCP/79 would likely be constrained at the cloud network boundary, reducing the attacker's ability to retrieve the remote payload from attacker-controlled infrastructure outside the trusted egress policy.
Control: Zero Trust Segmentation
Mitigation: Zero Trust segmentation would likely constrain the scope of what the compromised endpoint could reach within the broader environment, reducing the attacker's ability to pivot or expand access beyond the initially infected workload even while operating within the user session.
Control: East-West Traffic Security
Mitigation: East-west traffic enforcement would likely constrain the attacker's ability to move laterally from the compromised endpoint to other workloads or cloud resources, as segmentation policies would reduce reachability between hosts that have no defined reason to communicate.
Control: Multicloud Visibility & Control
Mitigation: Centralized multicloud visibility would likely surface anomalous outbound connection patterns over nonstandard ports such as TCP/725 and TCP/79, and policy enforcement could constrain outbound flows to attacker-controlled domains that fall outside approved egress destinations.
Control: Egress Security & Policy Enforcement
Mitigation: Egress policy enforcement would likely reduce the attacker's ability to exfiltrate harvested credentials and session tokens over nonstandard ports, as outbound flows over TCP/79 and TCP/725 to non-approved external destinations could be constrained at the cloud network egress boundary.
With lateral movement constrained and egress paths reduced by prior CNSF enforcement, the attacker's ability to escalate from a single endpoint compromise into broader cloud resource access or multi-account takeover would likely be limited, leaving residual risk concentrated at the initially compromised endpoint rather than spreading across the environment.
Impact at a Glance
Affected Business Functions
- End-User Workstation Integrity and Credential Security
- Corporate Identity and Access Management (IAM)
- E-commerce and Retail Search Advertising Channels
- Remote Workforce Endpoint Security
Estimated downtime: 1 days
Estimated loss: N/A
Victims who completed the fake CAPTCHA interaction and executed the delivered payload are at risk of exposure of browser-stored credentials, session tokens, saved passwords, cryptocurrency wallet data, and personally identifiable information (PII) harvested by Lumma Stealer. Additionally, installation of a covert NetSupport Client RMM tool enables persistent remote access to compromised endpoints, creating ongoing risk of further data exfiltration, lateral movement, or ransomware staging. Users who entered their email or phone number on the spoofed Amazon login page also face targeted phishing and account takeover risk for Amazon Business accounts.
Recommended Actions
Key Takeaways & Next Steps
- • Enforce egress security and policy enforcement controls (CNSF Egress Security & Policy Enforcement) to block outbound traffic on uncommon ports such as TCP/79 and TCP/725 used by finger.exe and NetSupport RMM; apply FQDN filtering to prevent connections to attacker-controlled barbeque-themed domains and unauthorized remote management infrastructure, directly disrupting both the initial payload retrieval and C2 channels.
- • Deploy multicloud visibility and control capabilities (CNSF Multicloud Visibility & Control) to establish behavioral baselines and alert on anomalous outbound traffic patterns, including unexpected use of legacy utilities like finger.exe, unusual staging activity under C:\ProgramData, and connections to nonstandard ports, enabling rapid detection of the multi-stage payload chain before exfiltration occurs.
- • Apply Cloud Firewall (ACF) controls with URL and FQDN filtering to block outbound connections to newly registered or low-reputation domains used as attacker infrastructure; configure AI-assisted traffic discovery to surface rare outbound protocols and port usage that bypasses conventional proxy-aware filters, closing the evasion advantage provided by finger.exe's non-proxy-aware design.
- • Implement Zero Trust Segmentation and east-west traffic security controls (CNSF Zero Trust Segmentation and East-West Traffic Security) to enforce least-privilege identity-based policies on workload-to-workload communication, preventing the NetSupport RMM client from facilitating lateral movement to additional internal hosts or cloud workloads using harvested credentials from Lumma Stealer.
- • Leverage Inline IPS (Suricata) with signature coverage for known Lumma Stealer payload patterns, ClickFix CAPTCHA delivery mechanisms, and NetSupport RMM command traffic to intercept and block malicious payloads at the network layer before they execute; complement with Encrypted Traffic (HPE) controls to ensure data-in-transit protections prevent harvested credentials from being exfiltrated undetected over covert channels operating on obscure ports.
