DEV Community

Anoymask
Anoymask

Posted on

Amazon ClickFix: Deploying NetSupport, Lumma, and More Using finger.exe and .plan Files

#security #threatintel

1. Basic Information

2. Executive Summary

An attack chain has been observed where users are directed from sponsored Google search ads for "Amazon Business" to fake Amazon login and CAPTCHA pages, triggering the execution of finger.exe via the clipboard to retrieve a remote .plan script over TCP port 79, which then launches a multi-stage loader to deploy multiple malware families.

3. Attack Flow

Windows Chain

Attack Stage Attacker Actions & Techniques Tools & Traffic Used Defender Detection & Blocking Points
Luring and Setup Directing users from sponsored search ads to a fake Amazon login Google Ads, fake Google Sites Detecting suspicious domain redirects from search ads
User Interaction (ClickFix) Storing malicious commands in the clipboard via a fake CAPTCHA Pastejacking, Run dialog Monitoring suspicious command execution in the Run dialog
Initial Payload Retrieval Retrieving a .plan file using finger.exe for execution by the Windows command processor finger.exe, outbound TCP/79 (Finger protocol) Blocking outbound TCP/79 at the firewall, restricting finger.exe execution
Multi-Stage Script & Malware Deployment Retrieving IronPython via curl and deploying subsequent payloads curl, IronPython, NetSupport Client, Lumma Stealer Detecting binary downloads from GitHub, unauthorized execution under ProgramData
  1. Users are directed from sponsored Google ads to a fake Amazon login page.
  2. A fake CAPTCHA screen copies obfuscated commands to the clipboard, prompting the user to paste and execute them in the Windows "Run" dialog.
  3. finger.exe retrieves the contents of a .plan file from an external server over TCP port 79, and the Windows command processor executes the retrieved content (finger.exe itself does not have script execution capabilities).
  4. The curl command downloads IronPython and other components from sources like GitHub, deploying multi-stage scripts.
  5. Subsequent malware such as NetSupport Client and Lumma Stealer is executed.

4. Attacker Infrastructure and Execution Location

  • The initial lure uses Google Ads and a fake Amazon login page on Google Sites, described by Huntress as a private Google Sites location.
  • On endpoint devices, finger.exe, cmd.exe, curl.exe, IronPython, and staging directories under ProgramData are abused.

5. Victim and Administrator Perspective

Victims

  • The pages mimic legitimate Amazon login screens and CAPTCHA authentication, displaying instructions to paste and execute commands in the "Run" dialog.

Administrators

  • Events may be observed as unusual outbound traffic on TCP port 79, the execution of finger.exe, and IronPython downloads from GitHub.

6. Conditions for Success and Failure

Conditions for Success

  • The user pastes and executes the pastejacked malicious command in the "Run" dialog.
  • Network reachability exists from the endpoint to outbound TCP port 79 and the payload download destination.
  • Application execution controls permit the execution of finger.exe, curl, and IronPython.

Conditions for Failure and Countermeasures

  • Blocking suspicious links in sponsored search ads and users refraining from executing instructions.
  • Blocking outbound TCP port 79 at the network boundary or endpoints, disabling finger.exe, and applying script execution controls.
  • Blocking payload distribution sources and C2 traffic, and immediately isolating endpoints using EDR.

7. What Happens Upon Success

  • Theft of credentials and browser data by infostealers.
  • Establishment of remote access via NetSupport Client.
  • Download of additional payloads and further compromise within the organization.

8. Observable Logs

Inference: The following are candidate logs to check within your organization. Applicability depends on logging configuration, retention periods, and monitoring scope, and should be distinguished from what the source verified for each event.

  • Email: None applicable
  • Proxy / SWG / DNS: Download traffic from Google Sites, attacker-controlled domains, and GitHub
  • Endpoint / EDR: cmd.exe or finger.exe spawned from the user's Run dialog (not necessarily a direct child process of the browser), curl, IronPython, file creation under ProgramData, and execution of NetSupport/Lumma
  • Identity / IdP: Unauthorized use of stolen credentials
  • SaaS / Cloud: Abuse of Google Ads and Google Sites
  • Network: Outbound TCP/79, TCP/725, and C2 traffic

9. Attack Success Determination

  • User Interaction Confirmed (user_action): Criteria: The initial action is established when the command is executed in the Run dialog.
  • Initial Execution Confirmed (initial_execution): Criteria: Confirmation of remote .plan retrieval via finger.exe and IronPython download.
  • Malware Execution or Authentication Success Confirmed (malware_or_authentication_success): Criteria: Confirmation of processes such as NetSupport or Lumma starting, persistence configuration, and C2 communication.

10. Investigation Playbook

  • Trigger: Execution of finger.exe, outbound TCP port 79 traffic, reports of access to fake CAPTCHA screens
  • Initial Verification: Preserve browser history, clipboard history, process tree, and network connection logs
  • Endpoints: Check for suspicious files under ProgramData, presence of IronPython, payloads, and persistence mechanisms
  • Identity and Cloud: Immediately revoke browser-stored credentials and session tokens
  • Subsequent Activity: Verify NetSupport session establishment, exfiltration by Lumma, and the presence of additional payloads
  • Containment: Isolate endpoints from the network, completely block TCP port 79, and rotate credentials
  • Phase Classification: Luring contact / User execution / Loader deployment / Malware infection and data exfiltration

11. Defense and Detection Ideas

  • Single Event: Execution of finger.exe during an interactive user session or communication to outbound TCP port 79
  • Timeline Correlation: Google Ads click -> Google Sites access -> finger.exe execution -> curl execution -> payload deployment
  • Hunting Perspective: Combination of rare LOLBin execution and binary downloads from GitHub
  • Logging Gaps: Lack of clipboard contents or telemetry for execution via the Run dialog
  • Priority Countermeasures: Blocking TCP port 79, application control, and user awareness training regarding ClickFix techniques

12. Facts / Inference / Hypothesis

Facts

  • Users were directed from sponsored Google search results to a fake Amazon page on an attacker-controlled domain.
  • A fake CAPTCHA displayed after entering an email address or phone number stored a malicious command in the clipboard and instructed the user to execute it via the Run dialog.
  • The command used finger.exe to retrieve the contents of a .plan file from an attacker server and passed it to the Windows command processor for execution.
  • The remote .plan file used 68 line breaks to push the script out of view and retrieved IronPython from GitHub.
  • Ultimately, at least three types of infostealers and remote access payloads were deployed.

Inference

  • TCP port 79 often falls outside routine monitoring, and abusing an infrequently used LOLBin can contribute to detection evasion.

Hypothesis

No additional hypotheses. Unconfirmed items are noted in "Open Questions and Further Investigation."

13. MITRE ATT&CK Mapping

ID Technique Confidence Basis
T1204.004 User Execution: Malicious Copy and Paste high Huntress's fake CAPTCHA prompts users to copy, paste, and execute malicious commands.
T1105 Ingress Tool Transfer high Retrieves IronPython and subsequent payloads.

14. Open Questions and Further Investigation

  • An alternative chain prepared for macOS was offline at the time of investigation, and the deployed payload remains unverified.
  • The exact number of victims and the attribution of the threat actor for the overall campaign are unknown.

15. Impact on SOCs and Organizations

Organizations should account for lures that abuse search advertisements and the Amazon brand. Because HTTP proxies alone cannot directly control TCP port 79, organizations should block TCP port 79 by default using boundary firewalls and outbound endpoint traffic controls, and monitor for correlations involving finger.exe, the Run dialog, curl, IronPython, and ProgramData staging.

16. Summary by Role

  • For SOCs: Correlate the activity sequence from browser access to the Run dialog, finger.exe, TCP/79, curl, IronPython, and payload execution. This is an activity sequence, not necessarily a direct parent-child process chain.
  • For Administrators: Disable finger.exe in environments where it is unneeded, and monitor and block outbound TCP/79 traffic as well as downloads originating from Google Sites and ads.
  • For Users: If CAPTCHA authentication prompts you to paste into the "Run" dialog, PowerShell, or a terminal, do not execute it and report it immediately.

Top comments (0)