As reported by Dark Reading, threat actors are weaponizing a decades-old Windows utility — the finger command — in conjunction with the increasingly popular ClickFix social engineering framework to distribute the Lumma stealer malware through poisoned Google search results related to Amazon.

Threat Alert: As reported by Dark Reading, threat actors are weaponizing a decades-old Windows utility — the finger command — in conjunction with the increasingly popular ClickFix social engineering framework to distribute the Lumma stealer malware through poisoned Google search results related to Amazon.

This campaign is a textbook example of what we at Shield53 call legacy utility abuse — the repurposing of obscure but built-in operating system tools that most defenders have long forgotten about. The finger utility, dating back to the early days of UNIX and later ported to Windows, was designed for querying user information on remote systems. It has no legitimate use in modern enterprise environments, yet it remains available on Windows systems and can execute arbitrary commands when invoked with crafted arguments. Security tools rarely flag it because it is a signed, native binary — making it an ideal candidate for living-off-the-land techniques.

Why This Attack Chain Is Effective

The campaign exploits three separate defensive blind spots simultaneously:

Why This Attack Chain Is Effective
SEO poisoning: Malicious pages rank highly for Amazon-related search terms, lending false legitimacy to the landing pages. Users trust Google results implicitly.
ClickFix social engineering: The fake CAPTCHA prompt tricks users into running commands via clipboard copy-paste, bypassing traditional email-gateway and browser-based defenses that look for malicious attachments or drive-by downloads.
Living-off-the-land execution: Using finger.exe to launch the payload means the initial execution step blends into normal system activity. Application whitelisting solutions that trust native Windows binaries will not flag it.

The end goal — Lumma stealer — is one of the most prolific info-stealing malware families currently in circulation. It aggressively harvests browser credentials, cryptocurrency wallets, session cookies, and autofill data, then exfiltrates it to attacker-controlled C2 infrastructure. Once those session cookies are in enemy hands, MFA provides no protection against session hijacking.

Who Is Most at Risk

This campaign disproportionately affects organizations with:

  • Permissive web browsing policies where users can access Google search and arbitrary URLs without sandboxing
  • Endpoint detection solutions that lack behavioral monitoring for native binary abuse
  • Heavy reliance on browser-based authentication and SSO portals (session cookie theft is the primary impact)
  • Cryptocurrency holdings or access to financial platforms through corporate endpoints

Retail, e-commerce, and logistics sectors are particularly exposed given the Amazon-themed lures, but any organization with general-purpose internet browsing is a viable target.

Broader Implications

The reuse of finger.exe signals a broader trend: threat actors are mining the full inventory of Windows native binaries for execution and evasion opportunities. Defenders who focus exclusively on PowerShell, WMI, and CMD as living-off-the-land vectors are leaving significant detection gaps.

We expect to see continued innovation in ClickFix-style attacks throughout 2026. The framework's success rate — driven by its exploitation of user trust in interactive verification prompts — makes it one of the most effective initial access methods currently observed. Combined with legacy utility abuse, this attack pattern will likely expand to incorporate other forgotten Windows binaries such as certutil, bitsadmin, and mshta in novel combinations.

Shield53 Recommendations

Immediate Actions

  • Disable or remove finger.exe on all Windows endpoints via Group Policy or application control policy. There is zero legitimate business use case for this binary in modern environments.
  • Deploy EDR detection rules for any execution of finger.exe with command-line arguments containing URLs, IP addresses, or pipe characters. Treat all such executions as suspicious regardless of parent process.
  • Implement browser isolation or sandboxing for general web browsing, especially for users handling financial transactions or cryptocurrency activities.
  • Audit session token lifetimes on critical SSO and cloud platforms. Implement conditional access policies that invalidate sessions based on impossible travel or device fingerprint anomalies.
  • Add clipboard monitoring controls to detect when users paste command-line instructions sourced from web pages — a hallmark of ClickFix attacks.

Strategic Hardening

  • Conduct a full inventory of legacy Windows utilities (finger, ftp, telnet, rexec, rsh) and disable all that are not explicitly required by a documented business process.
  • Enhance user awareness training to specifically address fake CAPTCHA and verification prompt lures. The ClickFix pattern is now common enough that targeted training is warranted.
  • Deploy DNS filtering and safe browsing extensions that can flag or block known ClickFix landing page patterns, including fake Cloudflare Turnstile and hCaptcha imitations.