Amazon-Themed ClickFix Campaign Serves Up Finger-Licking Malware
Source AlienVault OTX General
Description
A malware campaign used a sponsored Google search result to redirect victims to a spoofed Amazon login page on Google Sites. The page displayed a fake CAPTCHA (ClickFix) that tricked users into running a malicious command via the Windows finger utility, initiating a multi-stage infection. Payloads included IronPython, obfuscated Python scripts, Doina malware, Lumma Stealer via a Node.js package, and a pirated NetSupport Client RMM tool. The campaign used barbecue-themed domains for command and control and had alternate payloads for macOS. Attackers employed advanced obfuscation techniques such as Base64 with Cyrillic substitution, XOR, and RC4 encryption.
Impact
The campaign results in multi-stage malware infection capable of stealing information (Lumma Stealer), remote management via pirated NetSupport Client, and deployment of additional malware (Doina). The use of living-off-the-land binaries like the Windows finger utility and advanced obfuscation techniques complicates detection and mitigation. Multiple organizations were affected, indicating a potentially broad impact. The presence of macOS payloads suggests cross-platform targeting.
Defensive guidance
No official patch or fix is applicable as this is a malware campaign leveraging social engineering and living-off-the-land binaries. Mitigation should focus on user awareness to avoid executing suspicious commands, blocking access to known malicious domains (barbecue-themed domains used for C2), and employing endpoint detection capable of identifying obfuscated scripts and unusual use of legitimate utilities like finger. Network monitoring for suspicious outbound connections to the identified infrastructure is recommended. Since the campaign uses Google Sites for hosting, monitoring and reporting malicious sites to Google may help reduce exposure.
MITRE ATT&CK techniques
- T1566.002Phishing: Spearphishing Link · Initial Access (opens in a new tab)
- T1059.003Command and Scripting Interpreter: Windows Command Shell · Execution (opens in a new tab)
- T1204.002User Execution: Malicious File · Execution (opens in a new tab)
- T1055.012Process Injection: Process Hollowing · Stealth, Privilege Escalation (opens in a new tab)
- T1027Obfuscated Files or Information · Stealth (opens in a new tab)
Indicators of compromise
Domains 10
- grillmasterchef.com
- ashevilleroofingcontractor.com
- grillrecipespro.com
- homelygrill.com
- kiriosyka.com
- liokida.com
- perfectgrillrecipes.com
- thegrilljournal.com
- orders-amazon-com.advancedfences.com
- orders-amazon.com.advancedfences.com
URLs 7
- http://167.148.201.106:725/fakeurl.htm
- http://ashevilleroofingcontractor.com/curl/bc9e2dac08fb4f83dddb44f89bf7082bb4134697fbf6a99ad8ce30c634e9fe8a
- http://grillmasterchef.com/90e4a147-1234-505c-a024-062e543b5df8/timer6
- http://orders-amazon-com.advancedfences.com/?gadsource=1&gadcampaignid=24300910299&gbraid=0AAAAAB5-hUQ67k8UWBU5316Kpe0DHQvLm&gclid=Cj0KCQjw5vLVBhCiARIsAD56SFKcNIrijpItFZHromjAHhVv8sQjArpaK4rTubr7G3kENmeATgbev2QaAs7pEALw_wcB
- https://grillmasterchef.com/90e4a147-1234-505c-a024-062e543b5df8/v6
- https://kiriosyka.com/KsxmmKiN5N0j/sqr-viewertr6
- https://liokida.com/KsxmmKiN5N0j/sqr-viewertr6z
IP addresses 1
- 167.148.201.106
Hashes 11
CVEs 2
- CVE-2026-109618
- CVE-2026-109619