Huntress details Amazon ClickFix campaign that delivered alleged Lumma Stealer and NetSupport

Huntress released its findings about an Amazon-themed ClickFix operation that distributed what the company labeled allegedly Lumma Stealer alongside NetSupport remote monitoring and management software, based on at least three customer incidents. Those incidents began with ClickFix lures abusing ChatGPT, Google Docs, and other trusted tools, and one chain opened with malvertising that placed a sponsored result for “amazon business” at the top of Google search results, hosted at orders-amazon[.]com[.]advancedfences[.]com. Clicking the link sent visitors to a fake Amazon login page at sites.google[.]com/view/ch-pc/sign-in, where the page requested an email address or phone number. When users pressed the CAPTCHA button, a ClickFix command was saved to the clipboard, and a pop-up instructed the user to paste it into the Windows Run dialog.

Users arriving with a macOS browser User-Agent received alternate instructions to run a script in the Mac Terminal application instead. The macOS endpoint at hxxp[://]ashevilleroofingcontractor[.]com/curl/bc9e2dac08fb4f83dddb44f89bf7082bb4134697fbf6a99ad8ce30c634e9fe8a was offline when Huntress conducted its research.

The ClickFix command used finger.exe to reach DLVBUCeFfF@grillrecipespro[.]com. To hide the instruction, attackers inserted commas, carets, hyphens and underscores between characters, marks the Windows command interface ignores. The real command was buried under extra spaces and hyphens, leaving the Run box looking as though it contained Push the Enter key. Finger sends plaintext across port 79/TCP by default, and most networks allow this traffic to pass.

A weaponized script was concealed in the attacker’s .plan file using 68 extra carriage returns beyond normal terminal console screen height. The script fetched IronPython.3.4.2.zip from github[.]com/IronLanguages/ironpython3/releases/download/v3.4.2/IronPython.3.4.2.zip using curl and then decompressed the archive. The archive was stored in the user’s Temp folder under a .pdf name and then unpacked with tar.

Moving into \\\\net462, the script passed a Base64-encoded zlib-compressed Python blob to ipyw32.exe, the interpreter bundled with IronPython. That blob fetched data from hxxp://grillmasterchef[.]com/90e4a147-1234-505c-a024-062e543b5df8/timer6. The timer6 file consisted of a Base64-encoded Python script in which certain Latin characters had been replaced with Cyrillic substitutes.

The script borrowed pieces of the deprecated Veil shellcode_inject flat.py module, specifically matching HeapCreate and HeapAlloc flags. After decoding, timer6 revealed a second Python script that wrapped XORed data in another Base64 encoding layer. A separate Base64 blob held the 19-byte XOR key protecting the shellcode layer.

Written in hexadecimal, the key read 84 0d ff da 80 29 b6 1b 52 9b 42 40 5d 55 aa 80 a5 7e 7c. The decoded script produced a Windows PE loader that scanned the disk for a particular .ini file holding a URL. The file arrived with the user-agent string Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36, and the loader applied RC4 decryption to it. It contacted hxxps://grillmasterchef[.]com/90e4a147-1234-505c-a024-062e543b5df8/v6 and converted the retrieved content into a separate malware executable.

Security vendors classified the v6 file as Doina, a modular tool that can operate as a remote access trojan, infostealer, or profiler. According to Halcyon, Doina came before ransomware attacks in 2024. Once running, Doina sent HTTPS POST messages to the server at grillmasterchef.

The Doina module pulled a 52MB ZIP archive from hxxps://kiriosyka[.]com/KsxmmKiN5N0j/sqr-viewertr6. Inside the archive sat a complete portable Node.js instance along with a malicious, heavily obfuscated index.js script. Malware code extracted the ZIP into C:\\\\ProgramData\\\\NodeView and launched index.js through node.exe.

Components in the attack dropped payloads, logs, and associated files into C:\\\\ProgramData\\\\ and its subdirectories. The index.js script works as modular malware that fetches, decrypts, and injects encrypted payloads into memory without writing them to disk. The Node component retrieved two more files with random names resembling GUIDs. The two files measured roughly 17KB and more than 19MB respectively.

Both files lacked a recognizable PE header and displayed high entropy. The index.js script unscrambled both files with AES-256-GCM encryption. The nonce occupied the opening 12 bytes, while the key filled the following 16 bytes.

Huntress identified the larger file as allegedly Lumma Stealer, and the smaller file worked as a shellcode reflective DLL injector that loaded it. Using process hollowing, the injector put the stealer into memory, and the malware began beaconing at once. An initial HTTPS POST connection carried the hostname, username, and profiling details from the stealer.

Continuous monitoring took place over the websocket protocol after the initial connection. Browser targets included Chrome, Edge, Firefox, and Opera. Cryptocurrency programs in its sights included Ledger, Electrum, and Atomic Wallet. Password managers such as LastPass, Dashlane, 1Password, NordPass, and RoboForm were also on the list.

Email clients and PowerShell were included among the targeted software.

The stealer checked in with perfectgrillrecipes[.]com before sending data to thegrilljournal[.]com and homelygrill[.]com. A string inside the stealer held liokida[.]com, while an earlier variant obtained the stealer payload from kiriosyka[.]com. Using the query string ?exclude_bins=true, index.js could download only payload files under 20MB or a complete update package of about 58MB. Every payload download produced a uniquely hashed archive because random null bytes were added at request time.

The payload archives rotated one or two times per day. Inside C:\\\\ProgramData\\\\, attackers placed a pirated copy of NetSupport remote monitoring and management software in a folder named Prodclear. License and copyright details from NetSupport indicated an installation age of at least eight years. The executable carried a cryptographic signature dating back eight years.

Detailed activity logs were stored in a subdirectory, and NetSupport used HTTPS over nonstandard port 725/TCP to reach IP address 167.148.201[.]106. Command and control traffic from the NetSupport Client connected to fakeurl.htm located at that IP address. Command and control and payload delivery relied on barbecue-themed domains such as GrillRecipesPro, TheGrillJournal, EmbersAndBites, GrillMasterChef, and HomelyGrill. Huntress mapped domain connections by identifying shared hosting and DNS infrastructure and by tracking payloads that communicated with or originated from those domains.

Liokida and Kiriosyka served as hosts for Lumma Stealer and Node.js payload packages, including malicious payloads that were not invoked in this attack. The IP address 167.148.201.106 supports only the legitimate website of a Detroit restaurant, with no observed abuse of that domain.

Huntress analysts reverse-engineered a MacSync Stealer sample in August from an incident that started with a sponsored Google result. The search that led to that incident was how to install Claude on a Mac. Signs of Google ad-click redirects include aclk in the URL path and gclid in query strings. Investigators can reconstruct ad chains by examining browser history, proxy logs, or URL telemetry for these markers.

Legitimate CAPTCHA prompts never ask users to paste text into an operating system command prompt. Through malvertising, malicious links can appear inside Google’s paid advertising function. Submitting these identifiers to Google can block attacker access to the ad ecosystem until fresh accounts are created.

Attack Reduction within Huntress Managed ESPM Early Access allows administrators to turn access to the Windows Run dialog on or off. The tool cannot block every ClickFix variant, since attackers sometimes steer users toward PowerShell, the command prompt, or the Windows Explorer address bar.

This year, ClickFix accounted for approximately 2.2 percent of signals from Huntress Managed Endpoint Detection and Response. Nearly 99 percent of those ClickFix detections carried high severity ratings. Campaign indicators of compromise were published by Huntress on its GitHub repository.