ClickFix campaign abuses legacy Windows 'finger' utility to deliver Lumma stealer

Threat actors are using malicious Google ads for Amazon to lure victims into a CAPTCHA that invokes the legacy Windows 'finger' client, which then fetches and executes a payload installing the Lumma infostealer. This marks a novel abuse of a decades-old utility, expanding the ClickFix attack chain. The campaign is active and targets users via search-engine results, with the exact scale and distribution still unclear.

AI disclosure: Model-written summary of the source, not a verified fact. Check the sources. How Mosaic works