Decades-Old Windows Utility Powers Modern ClickFix Attack
Summary
Attackers are exploiting a decades-old Windows utility called 'finger' in a novel attack chain dubbed 'ClickFix'. This attack leverages malicious Google search results, particularly those targeting Amazon customers, to trick users into triggering a CAPTCHA that ultimately deploys malware like the Lumma stealer.
IFF Assessment
This article describes a new attack technique that leverages an old utility to deliver malware, posing a threat to defenders.
Defender Context
Defenders need to be aware of the evolving tactics used to deliver malware, even through seemingly innocuous or outdated system utilities. The use of social engineering via search results combined with the exploitation of legacy tools highlights the need for robust endpoint security and user education to prevent falling victim to such campaigns.