Researchers Warn of ClickFix Campaign Targeting Amazon Business Users

Cybersecurity researchers have discovered a campaign that abuses sponsored search results for “Amazon Business” to lure users to a convincing fake Amazon login page. After entering their details, victims are presented with a fraudulent CAPTCHA that secretly copies a command to their clipboard and instructs them to paste it into the Windows Run dialog. This social engineering technique, which is known as ClickFix, relies on user interaction rather than exploiting a software vulnerability.

According to a new report from Huntress, this campaign is noteworthy due to its abuse of finger.exe, which is a decades-old Windows utility that is rarely used today. Attackers leverage this legitimate tool to retrieve additional malicious code from their infrastructure, which helps the attack blend in with normal system activity and evade basic security controls.

Stealthy malware delivery and credential theft

Once the victim executes the command, the attack launches a multi-stage infection chain that can deploy information-stealing malware and unauthorized remote access tools. This campaign affected multiple customers and resulted in the installation of payloads, including Lumma Stealer and a rogue deployment of NetSupport Client. This gives attackers opportunities to steal credentials, harvest sensitive data, and establish persistent access to compromised systems.

It’s important to note that traditional security tools often focus on detecting malicious files or exploits. ClickFix attacks evade these defenses by persuading users to execute seemingly harmless commands themselves, which makes the initial stages difficult to detect before damage occurs.

Focus on user awareness and behavioral detection

Huntress researchers recommend shifting attention from signature-based defenses toward behavioral monitoring and user education. Organizations should train employees to treat any website that asks them to copy and paste commands into Windows Run, PowerShell, or Terminal as highly suspicious. Security teams should also monitor for unusual use of tools such as finger.exe, block or restrict unnecessary network communication over port 79, and strengthen detection capabilities around living-off-the-land binaries (LOLBins).

Other safeguards include reviewing web-filtering policies, improving visibility into user-executed commands, and investigating sponsored search results that could be abused for malvertising campaigns.

This report highlights that defending against ClickFix-style attacks often requires tighter restrictions on native system tools and closer monitoring of user actions. These measures can significantly reduce risk, but they may also introduce operational friction, generate additional alerts for security teams, and limit the flexibility administrators rely on for legitimate troubleshooting. Organizations must balance improved security visibility against the potential impact on user productivity and IT workflows.