Decades-Old Windows Utility Powers Modern ClickFix Attack

A 1970s-Era Protocol Tool Gets a ClickFix Makeover

Dark Reading reports a ClickFix campaign that pairs malicious Google search results themed around Amazon with the finger utility, a legacy Windows command that is still shipped with the operating system. The lure presents a fake CAPTCHA, and following its instructions ends with malware on the machine, including the Lumma infostealer.

The public write-up is brief, and this article covers only what it states. Specific commands and domains were not available at the time of writing.

Details

How the Attack Works

ClickFix attacks follow a common pattern. A victim lands on a page showing a fake CAPTCHA or error and is told to press a key combination to open the Windows Run dialog, paste a command that the page has silently copied to the clipboard, and press Enter. The victim runs the attacker's code themselves, so file-scanning email and web gateways have little to inspect.

In this campaign the pasted command leans on finger, a decades-old tool for querying user information on remote hosts over TCP port 79. Because the binary is legitimate and signed by Microsoft, it can be used to retrieve attacker-controlled content while looking unremarkable to tools that focus on PowerShell and similar usual suspects. Microsoft has previously recommended restricting outbound access for finger after seeing it abused in other campaigns.

Impact Assessment

Recommendations

For IT Admins

• Block outbound TCP port 79 at the perimeter; almost no modern environment needs finger
• Use AppLocker or WDAC to restrict finger.exe along with mshta.exe, wscript.exe, and cscript.exe where they are not needed
• Consider disabling the Run dialog for users who have no need for it

For Security Teams

• Alert on finger.exe process creation, especially when launched from explorer.exe or a Run dialog and piped into another interpreter
• Hunt for browser sessions that precede a clipboard-pasted command execution
• Rotate credentials and invalidate sessions on any endpoint where Lumma is confirmed

For End Users

• Never paste a command into the Run dialog or a terminal because a web page says to; no genuine CAPTCHA requires it
• Reach Amazon through bookmarks or the app rather than search-result ads

Key Takeaways

1. Legacy binaries are still attack surface — finger has little legitimate use today but ships by default
2. ClickFix keeps evolving its tooling — attackers rotate through built-in utilities to dodge detections tuned to PowerShell
3. Network and application controls help — blocking port 79 and restricting finger.exe close this path cheaply
4. Search ads remain a delivery channel — brand-themed results are a dependable lure

Sources

• Decades-Old Windows Utility Powers Modern ClickFix Attack — Dark Reading
• Think before you Click(Fix): Analyzing the ClickFix social engineering technique — Microsoft Security Blog