ClickFix attack abuses decades-old Windows finger utility to drop Lumma

Researchers detailed a ClickFix campaign where malicious Google search results about Amazon trigger a fake CAPTCHA. The page abuses the long-standing Windows finger utility to launch the CAPTCHA, which then installs malware including the Lumma stealer.

• Attack starts with malicious Google search results about Amazon
• Fake CAPTCHA is launched via the Windows finger utility
• Payload is the Lumma information stealer
• Campaign belongs to the ClickFix attack family