Threat feed

Amazon ClickFix (Doina)

Amazon-themed malvertising ClickFix: finger.exe LOLBin staging delivers Doina loader and suspected Lumma Stealer via process hollowing

Posted · Updated · Spectrum Delta Research Team

Summary

Huntress Labs (Oct 21, A/3) documents an Amazon-themed ClickFix campaign observed hitting at least three Huntress customers: a sponsored Google ad for 'amazon business' leads to a spoofed Amazon login whose fake CAPTCHA pastejacks a Windows Run-dialog command that invokes finger.exe to fetch a staged script, ending in a Doina loader, a suspected Lumma Stealer injected via process hollowing, and a pirated NetSupport RMM.

Breakdown

Adversary

Unknown — the primary provides no attribution to a named threat actor

Procedures (5)

  1. Sponsored-ad Amazon lure to pastejacked Run-dialog command

    User Execution: pastejacked command run from the Windows Run dialog after a sponsored-ad lure

    • T1204User Execution

    Logs

    • Windows process-creation events · finger.exe/curl/tar/ipyw32/node.exe creations; executed command lines
    • Web proxy / browser history · aclk/gclid ad markers; Google Sites staging; grill domains

    Detectors

    No known detector

Click to expand remaining (4) procedures

  1. finger.exe LOLBin fetches .plan stager over port 79/tcp

    finger.exe LOLBin retrieves a staged .plan script over Finger (79/tcp)

    • T1105Ingress Tool Transfer

    Logs

    • Windows process-creation events · finger.exe/curl/tar/ipyw32/node.exe creations; executed command lines
    • Network flow telemetry · Port 79/tcp Finger; 725/tcp NetSupport; HTTPS beacons to grill infra

    Detectors

    • Finger.EXE Execution (Sigma af491bca, T1105) · finger.exe process creation (rare utility, high severity)

  2. curl/tar/IronPython execution sequence from user Temp

    Interpreter staging: curl/tar/IronPython execution sequence from the user's Temp directory

    • T1059.006Command and Scripting Interpreter: Python

    Logs

    • Windows process-creation events · finger.exe/curl/tar/ipyw32/node.exe creations; executed command lines
    • EDR · Process hollowing; sRDI injection; ProgramData RMM installs

    Detectors

    No known detector

  3. node.exe executes decrypted payload pair from ProgramData

    Node.js runtime executes AES-256-GCM-decrypted payload pair from ProgramData\NodeView

    • T1059.007Command and Scripting Interpreter: JavaScript

    Logs

    • Network flow telemetry · Port 79/tcp Finger; 725/tcp NetSupport; HTTPS beacons to grill infra
    • EDR · Process hollowing; sRDI injection; ProgramData RMM installs

    Detectors

    No known detector

  4. Pirated NetSupport RMM beacons over HTTPS 725/tcp

    Pirated NetSupport Client RMM installed under ProgramData and beaconing on 725/tcp

    Logs

    • Network flow telemetry · Port 79/tcp Finger; 725/tcp NetSupport; HTTPS beacons to grill infra
    • EDR · Process hollowing; sRDI injection; ProgramData RMM installs

    Detectors

    No known detector

Indicators of compromise

Hunt only

(Huntress (https://www.huntress.com/blog/amazon-clickfix-finger), A/3) — ad/landing domain orders-amazon-com[.]advancedfences[.]com (sponsored Google result for 'amazon business', full gadsource/gadcampaignid/gbraid/gclid parameter set in the primary); Google Sites staging sites[.]google[.]com/view/ch-pc/sign-in; Finger staging account DLVBUCeFfF@grillrecipespro[.]com on 79/tcp; payload and C2 domains grillmasterchef[.]com, kiriosyka[.]com and liokida[.]com; exfil infrastructure perfectgrillrecipes[.]com, thegrilljournal[.]com, homelygrill[.]com; additional grill-themed infrastructure embersandbites[.]com; NetSupport C2 167.148.201[.]106 over HTTPS 725/tcp with path fakeurl.htm; drop locations C:\ProgramData\NodeView and C:\ProgramData\Prodclear; payload paths /90e4a147-1234-505c-a024-062e543b5df8/timer6 and /v6, /KsxmmKiN5N0j/sqr-viewertr6. Assessed 2026-10-24, hunt-only — the domains are perishable and the payload archives are hash-unique by design (the server appends random null bytes and the embedded payload changed once or twice per day), so archive-hash-only hunting is brittle and the durable hunt value is behavioral: finger.exe with remote-account arguments and 79/tcp egress, the curl/tar/ipyw32.exe sequence from user Temp, ProgramData RMM installs, and the ad-click markers in proxy history.

Detailed

Ad/landing: orders-amazon-com[.]advancedfences[.]com (sponsored result for 'amazon business'; full parameter set gadsource=1, gadcampaignid=24300910299, gbraid, gclid in the primary). Staging: sites[.]google[.]com/view/ch-pc/sign-in. Finger staging: DLVBUCeFfF@grillrecipespro[.]com on 79/tcp; .plan script hidden below 68 carriage returns. Payload paths: hxxp://grillmasterchef[.]com/90e4a147-1234-505c-a024-062e543b5df8/timer6; hxxps://grillmasterchef[.]com/90e4a147-1234-505c-a024-062e543b5df8/v6 (RC4 key in first 64 bytes); hxxps://kiriosyka[.]com/KsxmmKiN5N0j/sqr-viewertr6 (52 MB Node.js package); reported Liokida package hxxps://liokida[.]com/KsxmmKiN5N0j/sqr-viewertr6z; macOS branch hxxp://ashevilleroofingcontractor[.]com/curl/bc9e2dac08fb4f83dddb44f89bf7082bb4134697fbf6a99ad8ce30c634e9fe8a (offline at research time). Exfil: perfectgrillrecipes[.]com (initial check-in), thegrilljournal[.]com and homelygrill[.]com; additional infrastructure embersandbites[.]com. NetSupport: C:\ProgramData\Prodclear, 167.148.201[.]106:725/fakeurl.htm. Node drop: C:\ProgramData\NodeView (node.exe + index.js; AES-256-GCM pair about 17 KB + over 19 MB; updates about 58 MB or exclude_bins=true under 20 MB). Decoding: Base64+zlib Python blob to ipyw32.exe; timer6 with Cyrillic homoglyphs; 19-byte XOR key 84 0d ff da 80 29 b6 1b 52 9b 42 40 5d 55 aa 80 a5 7e 7c; RC4 key prepended as first 64 bytes of v6. Campaign window: observed incidents at publication; payload rotation once or twice per day with hash-unique archives. All from the primary (Huntress (https://www.huntress.com/blog/amazon-clickfix-finger), A/3).

Sources

Grades are source reliability (A–F) and information credibility (1–6).

Questions, detections or sightings of Amazon ClickFix (Doina)? Bring them to the community.

Discuss in the Tradecraft Slack