ClickFix Campaign Uses Amazon Lures to Deploy Malware

Summary

Threat actors are abusing sponsored Google search results for “amazon business” to redirect users to a spoofed Amazon login page. The site uses a ClickFix social engineering technique to trick victims into executing a command through the Windows Run dialog. That command abuses the legacy finger utility to download and launch a multi-stage malware chain involving Doina, Lumma Stealer, and NetSupport RMM.

Investigation

Huntress investigated multiple incidents linked to an Amazon-themed ClickFix campaign. Analysts reverse-engineered the infection chain and identified the finger utility being abused as a LOLBIN to retrieve a weaponized .plan file. The investigation traced the deployment of IronPython, the Doina RAT, and eventually Lumma Stealer through a Node.js-based loader.

Mitigation

The primary defense is user awareness around fake CAPTCHA prompts that instruct users to execute terminal commands. Organizations should consider disabling the Windows Run dialog for users who do not require it through managed endpoint security controls. Monitoring for unusual traffic over TCP port 79 used by finger and malvertising indicators in web logs can also support early detection.

Response

When this activity is detected, isolate affected endpoints to prevent further data exfiltration or lateral movement. Review and block identified barbecue-themed C2 domains and malicious IP addresses. Conduct a thorough hunt for unauthorized RMM software such as NetSupport and suspicious Node.js processes executing from non-standard locations including C:\ProgramData.

Simulation Execution

• Attack Narrative & Commands: An adversary has gained initial access and is attempting to establish persistence and command-and-control (C2). To blend in with common administrative traffic and exploit known protocol vulnerabilities, they utilize a Python script to initiate a connection on Port 79 (Finger protocol). Simultaneously, they attempt to use a NetSupport Client instance to transfer tools, specifically targeting a known malicious IP (172.148.201.106) on port 725 to maintain a backdoor.

• Regression Test Script:

  # Simulation script to trigger detection rule
  # Requirement: Python must be installed on the target
  
  Write-Host "[+] Starting Simulation..."
  
  # 1. Trigger Selection One: Connection to Port 79
  Write-Host "[+] Triggering Port 79 (Finger) connection..."
  python -c "import socket; s = socket.socket(socket.AF_INET, socket.SOCK_STREAM); s.connect(('127.0.0.1', 79)); s.close()"
  
  # 2. Trigger Selection Two: Connection to 172.148.201.106 on Port 725
  Write-Host "[+] Triggering NetSupport (IP: 172.148.201.106, Port: 725) connection..."
  python -c "import socket; s = socket.socket(socket.AF_INET, socket.SOCK_STREAM); s.connect(('172.148.201.106', 725)); s.close()"
  
  Write-Host "[+] Simulation Complete."

• Cleanup Commands:

  # No persistent artifacts created by this script; 
  # however, ensure any temporary python processes are terminated.
  Stop-Process -Name "python" -ErrorAction SilentlyContinue