A Fake Amazon Ad Ends in finger.exe, Lumma and a Hijacked PC

A sponsored Google result for “amazon business” led to a fake Amazon sign-in page and then a fake CAPTCHA that told visitors to paste a command into the Windows Run box, Huntress reports. The pasted command uses finger.exe, a decades-old Windows utility, to pull down a script that ends in the Lumma infostealer and a pirated NetSupport remote-access client. Huntress says at least three of its customers were hit. Google has pulled the ad, but the attackers’ servers were still up when the report was published on Oct. 21.

orders-amazon-com[.]advancedfences[.]com
grillrecipespro[.]com
grillmasterchef[.]com
kiriosyka[.]com
liokida[.]com
perfectgrillrecipes[.]com
thegrilljournal[.]com
homelygrill[.]com
167.148.201[.]106:725

d864b28c302db9ed10baf8def0fb26bac0b97d27349d22c4e9390d30fce54649 (timer6)
891cc3ca2d29e9b185a8913e93810f48859d2be1f23ddd977a15cdbeed509e0e (v6 / Doina)
035d396b3a329f59d680dc36a0a639eb7fb306bea97e42f5f53293dce817e8b7 (Nodeview.zip)

Source article: Amazon-Themed ClickFix Campaign Serves Up Finger-Licking Malware
Publisher: Huntress (Andrew Brandt, Sarah Reddish)
Published: Oct. 21, 2026
URL: https://www.huntress.com/blog/amazon-clickfix-finger

Executive Summary

Huntress describes a malvertising-to-ClickFix campaign that hit at least three of its customers in the months before Oct. 21, 2026. No threat actor is named and no vendor alias is reported; the final stealer is described as allegedly Lumma Stealer, and the in-memory loader is identified by vendor consensus as Doina, a modular loader, RAT and infostealer. A sponsored Google result for “amazon business” pointed to orders-amazon[.]com[.]advancedfences[.]com, which redirected to a fake Amazon sign-in page on Google Sites (sites[.]google[.]com/view/ch-pc/sign-in). After the visitor entered an email or phone number, a fake “I’m not a robot” CAPTCHA copied a command to the clipboard and told them to paste it into the Windows Run dialog, padded so only “Push the Enter key” showed. The command, obfuscated with commas, carets, hyphens and underscores, boils down to finger DLVBUCeFfF@grillrecipespro[.]com: finger.exe fetches that user’s .plan file over TCP 79, and the file is a script hidden below 68 carriage returns. The script uses curl to download the legitimate IronPython 3.4.2 release from GitHub, saves it in Temp with a .pdf extension, unpacks it with tar and runs ipyw32.exe from the net462 folder with a Base64, zlib-compressed Python blob. That blob fetches timer6 from grillmasterchef[.]com, which decodes into a PE loader that RC4-decrypts v6, the Doina payload, into memory. Doina downloads a roughly 52 MB package from kiriosyka[.]com and extracts a portable Node.js runtime and an obfuscated index.js into C:\ProgramData\NodeView. index.js pulls two AES-256-GCM-encrypted files, an sRDI injector and the stealer, which is injected by process hollowing and goes after browsers, crypto wallets, password managers and email clients, checking in with perfectgrillrecipes[.]com and exfiltrating to thegrilljournal[.]com and homelygrill[.]com. A pirated, signed NetSupport Client in C:\ProgramData\Prodclear calls 167.148.201[.]106 on TCP 725. Mac visitors got a Terminal variant whose payload was offline. Google removed the ad, but the infrastructure was still up at publication, and the Node package changed once or twice a day. The objective is credential and wallet theft plus hands-on remote access. Hunt leads, false-positive expectations, the absence of published rules and the indicators are detailed below.

ATT&CK chain: Resource Development → Execution → Defense Evasion → Credential Access → Command and Control → Exfiltration

Hunt Lead Grid

Barbecue-Themed C2, finger Host and NetSupport IP Sweep

Huntress traced every stage to a small set of hosts, most of them barbecue- or recipe-themed. The lure was the sponsored link to orders-amazon[.]com[.]advancedfences[.]com, carrying Google ad-click markers (gadsource, gadcampaignid, gbraid, gclid), which redirected to sites[.]google[.]com/view/ch-pc/sign-in. The finger stage queried grillrecipespro[.]com on TCP 79. The timer6 and v6 payloads came from grillmasterchef[.]com under the path /90e4a147-1234-505c-a024-062e543b5df8/, and Doina also sent HTTPS POSTs there. The Node package came from kiriosyka[.]com/KsxmmKiN5N0j/sqr-viewertr6, and the stealer embeds liokida[.]com, which serves the same path shape. The stealer checked in with perfectgrillrecipes[.]com and exfiltrated to thegrilljournal[.]com and homelygrill[.]com; Huntress also lists EmbersAndBites[.]com. The macOS variant pointed at ashevilleroofingcontractor[.]com under /curl/. NetSupport talked to 167.148.201[.]106 on TCP 725, requesting fakeurl.htm. The detection logic is a DNS, proxy and firewall sweep for every domain listed here, for the Google Sites path /view/ch-pc/, for the path fragments /90e4a147-1234-505c-a024-062e543b5df8/ and /KsxmmKiN5N0j/ on any host, and for outbound connections to 167.148.201[.]106 on port 725.

Use DNS resolver logs, secure web gateway or proxy logs with full URLs, and firewall or NetFlow records. Sweep back at least 90 days, since Huntress says the campaign ran for months before publication and the ad was only pulled afterward. Huntress’s IOC CSV on GitHub has the complete list in machine-readable form, so load it rather than retyping. Blocking the barbecue domains and the advancedfences[.]com subdomain is safe; blocking sites[.]google[.]com or github[.]com is the wrong control, because both are used legitimately everywhere, so match only the specific Google Sites path. Don’t block the IP outright without checking business impact, since it also serves a legitimate restaurant website; block or alert on TCP 725 to it instead. A visit to the lure or the Google Sites page means a user saw the trap. Any hit on the finger host, grillmasterchef[.]com, kiriosyka[.]com, liokida[.]com, the exfil domains or port 725 means the chain ran, and the host and user should go to incident response with password, session and wallet resets.

Hunt Lead Level: 1 (Junior Analyst)

ATT&CK: Command and Control → T1071.001 (Application Layer Protocol: Web Protocols), detection strategy DET0027 Detection of Web Protocol-Based C2 Over HTTP, HTTPS, or WebSockets (our mapping); Resource Development → T1583.008 (Acquire Infrastructure: Malvertising) (our mapping). Huntress publishes no ATT&CK mapping.

Sources: “Amazon-Themed ClickFix Campaign Serves Up Finger-Licking Malware”, Huntress, Oct. 21, 2026, https://www.huntress.com/blog/amazon-clickfix-finger (source article); Huntress threat-intel IOC file “20261021_IoC_finger-lickin-bad.csv”, https://github.com/huntresslabs/threat-intel/blob/main/2026/2026-10/20261021_IoC_finger-lickin-bad.csv (additional source, published by the same authors for this campaign)

NodeView and Prodclear Folder and Payload Hash Sweep

Doina extracts a roughly 52 MB ZIP into C:\ProgramData\NodeView, holding a portable node.exe, a node_modules folder and an obfuscated index.js, and runs node.exe with index.js as its argument. index.js downloads two encrypted files with GUID-style names ending in .tmp: an sRDI injector and the stealer. Huntress lists four decrypted stealer files under names such as 754224f2-3449-4ac7-8b13-1cb8e6af6408.tmp. Separately, a pirated NetSupport Client is installed in C:\ProgramData\Prodclear, with Client32.exe as the executable, signed by a certificate about eight years old and writing extensive logs to a subdirectory there. The detection logic is an EDR file-inventory and process sweep for any file or process under C:\ProgramData\NodeView or C:\ProgramData\Prodclear, for node.exe running from ProgramData with an index.js argument, for Client32.exe outside a sanctioned NetSupport install path, for .tmp files with GUID names written by node.exe, and for the SHA-256s in the appendix.

Use EDR file and process telemetry, Sysmon Events 1 and 11, and any software inventory that records ProgramData contents. Sweep back 90 days. The folder names are the durable anchor: Huntress says the Node package changed once or twice a day and the server appends random null bytes so every download hashes differently, so the Nodeview.zip and index.js hashes will miss newer victims. Don’t block node.exe or Client32.exe by hash, because both are legitimate binaries used here without modification and the block would hit real Node.js and NetSupport deployments; detect the location and the parent instead. If your organization uses NetSupport, allowlist its managed install path and signer and alert on any other copy. Any hit in NodeView or Prodclear is a confirmed infection: isolate the host, collect the NetSupport logs for the operator’s activity, and reset every credential and wallet used on the machine from a clean device.

Hunt Lead Level: 1 (Junior Analyst)

ATT&CK: Command and Control → T1105 (Ingress Tool Transfer), detection strategy DET0060 Detect Ingress Tool Transfers via Behavioral Chain (our mapping); Command and Control → T1219.002 (Remote Access Tools: Remote Desktop Software) (our mapping, for the pirated NetSupport Client)

Sources: “Amazon-Themed ClickFix Campaign Serves Up Finger-Licking Malware”, Huntress, Oct. 21, 2026, https://www.huntress.com/blog/amazon-clickfix-finger (source article)

finger.exe Reaching the Internet on TCP 79

The pasted command runs the Windows finger client against DLVBUCeFfF@grillrecipespro[.]com. finger.exe connects out on TCP 79 and prints the remote user’s .plan file, which here is a batch script pushed out of view by 68 carriage returns and executed by the shell the command was pasted into. The obfuscation (commas, carets, hyphens and underscores between characters, which cmd.exe ignores) means the literal string “finger” may not appear in the Run-dialog text or a naive command-line log, but the process that starts is still finger.exe. The detection logic is a process-creation rule for finger.exe whose command line contains an @ followed by a hostname, paired with a network rule for any outbound TCP 79 connection to an internet address. Raise severity when the parent is cmd.exe launched by explorer.exe (a Run-dialog paste), when the RunMRU registry key holds a long string full of carets and commas, or when finger.exe is followed within seconds by curl.exe or tar.exe on the same host.

Build this on EDR or Sysmon process-creation events (Event ID 1) with command lines, firewall or NetFlow logs for TCP 79, and the per-user HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU key. Sweep 90 days across all Windows endpoints. Legitimate finger use on Windows is almost nonexistent, so the easiest fix is preventive: block outbound TCP 79 at the perimeter and block finger.exe with application control for ordinary users. That breaks nothing most organizations rely on. Don’t rely on string matching the pasted text, which the carets defeat; match the process image instead. Any internet-bound finger.exe from a user session should be treated as a live ClickFix execution and triaged immediately. The lead generalizes well beyond this campaign, since finger.exe has been used as a ClickFix download stage by several unrelated operators.

Hunt Lead Level: 2 (Pro)

ATT&CK: Command and Control → T1105 (Ingress Tool Transfer), detection strategy DET0060 Detect Ingress Tool Transfers via Behavioral Chain (our mapping); Execution → T1204.004 (User Execution: Malicious Copy and Paste), detection strategy DET0340 User Execution – Malicious Copy & Paste (browser/email → shell with obfuscated one-liner) – T1204.004 (our mapping); the caret and comma padding also fits T1027 (Obfuscated Files or Information).

Sources: “Amazon-Themed ClickFix Campaign Serves Up Finger-Licking Malware”, Huntress, Oct. 21, 2026, https://www.huntress.com/blog/amazon-clickfix-finger (source article)

IronPython Archive Saved as PDF, Then ipyw32.exe With an Encoded Blob

The .plan script uses curl to download IronPython.3.4.2.zip from the official IronLanguages GitHub release URL (github[.]com/IronLanguages/ironpython3/releases/download/v3.4.2/IronPython.3.4.2.zip), saves it in the user’s Temp folder with a .pdf extension, and extracts it with tar. It then changes into the net462 folder and runs ipyw32.exe, the windowless IronPython interpreter, with a Base64, zlib-compressed Python blob on the command line. That blob fetches timer6 from grillmasterchef[.]com, a Python script whose Base64 swaps some Latin letters for Cyrillic look-alikes and then XOR-decrypts (19-byte key 84 0d ff da 80 29 b6 1b 52 9b 42 40 5d 55 aa 80 a5 7e 7c) a shellcode blob that becomes the loader. The loader requests v6 with the User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36. The detection logic is a chain of three single-source rules: curl.exe writing a file with a .pdf extension into %TEMP% from a GitHub release URL for a .zip; tar.exe extracting a file with a .pdf extension; and ipyw32.exe or ipy.exe launched from a path under %TEMP% with a command-line argument of several hundred characters of Base64.

Use EDR process and file-creation telemetry (Sysmon Events 1 and 11) and proxy logs that record the requested URL and the client User-Agent. Sweep 90 days. Developers on .NET can legitimately install IronPython, so scope by host role and anchor on the mismatch rather than on IronPython itself: a ZIP downloaded to a .pdf name, an interpreter run from Temp, and an encoded blob argument together have no benign use. Blocking github[.]com or the IronLanguages release is the wrong control, since it is a legitimate project and the attackers could switch to another interpreter; application control that blocks interpreters from running out of %TEMP% is a better one. The User-Agent string on its own is too generic to alert on, but a proxy request with exactly that truncated string to an uncategorized domain is a useful supporting signal. Any hit should be escalated, because the chain reaches the in-memory loader within seconds of ipyw32.exe starting.

Hunt Lead Level: 2 (Pro)

ATT&CK: Defense Evasion → T1036.008 (Masquerading: Masquerade File Type) (our mapping, for the ZIP saved as .pdf); Execution → T1059.006 (Command and Scripting Interpreter: Python) (our mapping); the Cyrillic-substituted Base64 and XOR layers in timer6 fit T1140 (Deobfuscate/Decode Files or Information).

Sources: “Amazon-Themed ClickFix Campaign Serves Up Finger-Licking Malware”, Huntress, Oct. 21, 2026, https://www.huntress.com/blog/amazon-clickfix-finger (source article)

Run-Dialog Paste to node.exe in ProgramData Chain

End to end, a single paste produces a short, distinctive sequence on one host: explorer.exe launches a shell from the Run dialog; finger.exe connects out on TCP 79; curl.exe and tar.exe fetch and unpack IronPython; ipyw32.exe runs from Temp; then, after Doina is decrypted into memory, a ZIP of roughly 52 MB arrives from kiriosyka[.]com and node.exe starts from C:\ProgramData\NodeView with index.js. node.exe then downloads two high-entropy files with GUID names, and the sRDI injector hollows a process to run the stealer, which POSTs host and user profiling data to perfectgrillrecipes[.]com and then holds a WebSocket session for search lists and heartbeats. NetSupport’s Client32.exe appears in C:\ProgramData\Prodclear and beacons on port 725. The detection logic is a sequence correlation keyed on host: a process tree rooted at explorer.exe containing finger.exe, curl.exe or tar.exe; followed within an hour by node.exe started from any ProgramData subfolder (not Program Files or a developer’s profile) that makes outbound connections; followed by either a new process with mismatched in-memory and on-disk image (the hollowing) or a long-lived WebSocket connection to an uncategorized domain. Weight the alert higher when Client32.exe or any remote-access tool starts from ProgramData on the same host in the same window.

This needs EDR process trees with network attribution, proxy logs that record WebSocket upgrades and response sizes, and ideally memory or image-integrity events for hollowing. Correlate on host and a 60-minute window, and keep a baseline of hosts where node.exe normally runs so developer machines don’t flood the rule; on everything else, node.exe from ProgramData is suspicious on its own. Back-test 90 days. The stealer targets browsers, wallets (Ledger, Electrum, Atomic Wallet), password managers (LastPass, Dashlane, 1Password, NordPass, RoboForm) and email clients, so a confirmed chain means assuming all of those secrets are gone: escalate to incident response, isolate the host, revoke sessions and rotate credentials from a clean device rather than tuning the rule. Hash-blocking node.exe is the wrong control, since it is the unmodified Node.js runtime. The pattern of a Run-dialog paste followed by a portable script runtime dropped into ProgramData is common to many recent ClickFix chains, so the correlation outlives this campaign’s infrastructure.

Hunt Lead Level: 3 (Elite)

ATT&CK: Execution → T1204.004 (User Execution: Malicious Copy and Paste), detection strategy DET0340 User Execution – Malicious Copy & Paste (browser/email → shell with obfuscated one-liner) – T1204.004 (our mapping); Execution → T1059.007 (Command and Scripting Interpreter: JavaScript), detection strategy DET0264 Cross-Platform Detection of JavaScript Execution Abuse (our mapping); Defense Evasion / Privilege Escalation → T1055.012 (Process Injection: Process Hollowing) (our mapping); Credential Access → T1555.003 (Credentials from Password Stores: Credentials from Web Browsers) (our mapping, for the stealer’s targets)

Sources: “Amazon-Themed ClickFix Campaign Serves Up Finger-Licking Malware”, Huntress, Oct. 21, 2026, https://www.huntress.com/blog/amazon-clickfix-finger (source article)

Hash Appendix

No published YARA, Sigma or other rules: Huntress gives no rule content in the post. All hashes are SHA-256 from the source article. OTX AlienVault had no file analysis for the Doina v6 hash, and the remaining hashes were not pivoted, so MD5 and SHA-1 are not available. The Node package changed daily and is padded with random null bytes, so treat these hashes as a retrospective check, not a block list.

timer6 (obfuscated Python stage)

MD5s

(not available)  # timer6 -> fetched from grillmasterchef[.]com by ipyw32.exe

SHA1s

(not available)  # timer6 -> fetched from grillmasterchef[.]com by ipyw32.exe

SHA256s

d864b28c302db9ed10baf8def0fb26bac0b97d27349d22c4e9390d30fce54649  # timer6 -> obfuscated Python script, decodes to the PE loader

Doina (v6, RC4-decrypted body)

MD5s

(not available)  # v6 -> Doina loader/RAT, run in memory (OTX: no record)

SHA1s

(not available)  # v6 -> Doina loader/RAT, run in memory (OTX: no record)

SHA256s

891cc3ca2d29e9b185a8913e93810f48859d2be1f23ddd977a15cdbeed509e0e  # v6 -> Doina, decrypted body injected into memory

Node.js stage (NodeView package)

The ZIP contains the unmodified, legitimate Node.js runtime; do not block node.exe by hash. The hashes below are for the package and the malicious script only.

MD5s

(not available)  # Nodeview.zip -> from kiriosyka[.]com, extracted to C:\ProgramData\NodeView
(not available)  # index.js -> C:\ProgramData\NodeView\index.js

SHA1s

(not available)  # Nodeview.zip -> C:\ProgramData\NodeView
(not available)  # index.js -> C:\ProgramData\NodeView\index.js

SHA256s

035d396b3a329f59d680dc36a0a639eb7fb306bea97e42f5f53293dce817e8b7  # Nodeview.zip -> portable Node.js runtime + index.js, extracted to C:\ProgramData\NodeView
87a047160eb1a9b92e6ede511252dfc624b0f5a7185ac2cec1c7ebde8cdf4eea  # index.js -> C:\ProgramData\NodeView\index.js (obfuscated downloader)

Stealer (allegedly Lumma, decrypted payloads)

MD5s

(not available)  # 754224f2-3449-4ac7-8b13-1cb8e6af6408.tmp -> decrypted stealer
(not available)  # 1572cef1-df62-4594-a3aa-a9db91b9d7db.tmp -> decrypted stealer
(not available)  # 29d37679-4112-4751-8613-15b94b29ad39.tmp -> decrypted stealer
(not available)  # 545b93c2-e4f7-4397-b32c-8a3c77538594.tmp -> decrypted stealer

SHA1s

(not available)  # 754224f2-3449-4ac7-8b13-1cb8e6af6408.tmp -> decrypted stealer
(not available)  # 1572cef1-df62-4594-a3aa-a9db91b9d7db.tmp -> decrypted stealer
(not available)  # 29d37679-4112-4751-8613-15b94b29ad39.tmp -> decrypted stealer
(not available)  # 545b93c2-e4f7-4397-b32c-8a3c77538594.tmp -> decrypted stealer

SHA256s

24a293a662600b2292d9259baebba1c09b41df82a5c9c20f8572625ae759696f  # 754224f2-3449-4ac7-8b13-1cb8e6af6408.tmp -> decrypted stealer, injected via process hollowing
b8419a676a3d4af04ea98287a2b85052fae5c06e6278ca9d8bfa4b5b396b39a6  # 1572cef1-df62-4594-a3aa-a9db91b9d7db.tmp -> decrypted stealer
42527a4388ef4ade6f4eaf52706f0ab31cb4e9ced3a56a6b15402551f9f01208  # 29d37679-4112-4751-8613-15b94b29ad39.tmp -> decrypted stealer
408b7fc4f08f2a9044046025f05995e8cbd5c96c39844aaa8a7eb8ee4697ea89  # 545b93c2-e4f7-4397-b32c-8a3c77538594.tmp -> decrypted stealer

Legitimate tools used by the chain (no hashes)

finger.exe, curl.exe and tar.exe are Windows built-ins; IronPython 3.4.2 (ipyw32.exe) and node.exe are unmodified legitimate releases; Client32.exe is a pirated but genuinely signed NetSupport Client. The source gives no hashes for them, and blocking any of them by hash would break legitimate software. Detect the path, parentage and network behavior instead.

MD5s

(not available)  # finger.exe / curl.exe / tar.exe -> Windows built-ins (do not block by hash)
(not available)  # ipyw32.exe -> %TEMP%\...\net462\ (legitimate IronPython 3.4.2)
(not available)  # Client32.exe -> C:\ProgramData\Prodclear\ (pirated NetSupport Client)

SHA1s

(not available)  # finger.exe / curl.exe / tar.exe -> Windows built-ins
(not available)  # ipyw32.exe -> %TEMP%\...\net462\
(not available)  # Client32.exe -> C:\ProgramData\Prodclear\

SHA256s

(not available)  # finger.exe / curl.exe / tar.exe -> Windows built-ins
(not available)  # ipyw32.exe -> %TEMP%\...\net462\
(not available)  # Client32.exe -> C:\ProgramData\Prodclear\

References Appendix

• “Amazon-Themed ClickFix Campaign Serves Up Finger-Licking Malware”, Huntress (Andrew Brandt, Sarah Reddish), Oct. 21, 2026, https://www.huntress.com/blog/amazon-clickfix-finger (source article; infection chain, commands, paths, infrastructure, SHA-256s)
• “20261021_IoC_finger-lickin-bad.csv”, Huntress threat-intel repository on GitHub, Oct. 21, 2026, https://github.com/huntresslabs/threat-intel/blob/main/2026/2026-10/20261021_IoC_finger-lickin-bad.csv (additional source; machine-readable IOC list for this campaign)
• AlienVault OTX file analysis lookup for 891cc3ca2d29e9b185a8913e93810f48859d2be1f23ddd977a15cdbeed509e0e, Oct. 29, 2026, https://otx.alienvault.com/indicator/file/891cc3ca2d29e9b185a8913e93810f48859d2be1f23ddd977a15cdbeed509e0e (no record; MD5/SHA-1 not available)
• MITRE ATT&CK Enterprise technique and detection-strategy pages linked above, MITRE, https://attack.mitre.org/