Fake Amazon ad on Google tricked users into running malware, Huntress says
A sponsored Google result for “amazon business” led to a fake Amazon sign-in page with a ClickFix lure, Huntress says, and the attacks hit at least three of its customers. The lure has victims run a command that uses Windows’ built-in finger utility to fetch a script. The chain then installs the Doina malware, a pirated copy of the NetSupport remote management tool and a stealer Huntress describes as a version of Lumma Stealer. Google removed the ad, but the attacker’s infrastructure was still up when Huntress published.
The ad pointed to a subdomain of that redirected to a fake Amazon page on Google Sites. After the victim entered an email address or phone number, a fake “I’m not a robot” check copied a command. It told the victim to run the command in the Windows Run box. Padding hides the command, so the box seems to say only “Push the Enter key.” Visitors on macOS got a different script, whose server was offline when Huntress looked.
The command runs finger.exe against an account on , whose .plan file holds a script. That script downloads IronPython from its GitHub releases page and runs an obfuscated script called timer6, which loads Doina into memory. Doina then fetches a portable copy of Node.js with a malicious index.js into C:\ProgramData\NodeView. The index.js file decrypts the stealer and a loader that injects it into memory.
The chain also installs a pirated, years-old NetSupport Client in C:\ProgramData\Prodclear. It talks over port 725 to , an address that also hosts a Detroit restaurant’s legitimate website. Most of the attacker’s domains are barbecue-themed, and Huntress says the payloads change once or twice a day, with each download carrying a different hash.
Huntress hasn’t named the group behind the campaign or said how many people clicked the ad. It says finger traffic over port 79 should be easy to detect or block, but few networks block it because almost no one uses finger anymore.
What to do
7 steps
- 2 Search endpoint logs for finger.exe contacting grillrecipespro[.]com, the lure’s first stage.
Indicators
Domains, URLs and IPs copy defanged. Use Copy raw for queries.
| Type | Value | Note |
|---|---|---|
| Domain | Hosted the subdomain the sponsored ad pointed to | |
| Domain | Finger server whose .plan file holds the first script | |
| Domain | Delivers timer6 and the Doina payload, and Doina’s command server | |
| Domain | Hosts the Node.js and stealer package | |
| Domain | Hosts stealer packages and is embedded in the stealer | |
| Domain | Stealer’s first check-in | |
| Domain | Receives stolen data | |
| Domain | Receives stolen data | |
| Domain | Command server and payload delivery, per Huntress | |
| URL | timer6 delivery | |
| URL | Encrypted Doina payload | |
| URL | Node.js package download | |
| URL | Node.js and stealer package download | |
| URL | macOS payload, offline when Huntress checked | |
| IP address | NetSupport command server on port 725, also hosts a legitimate restaurant site | |
| URL | NetSupport command path | |
| SHA-256 | timer6 script | |
| SHA-256 | Decrypted v6 payload, which Huntress identifies as Doina | |
| SHA-256 | Malicious index.js | |
| SHA-256 | Node.js package zip file, whose hash changes with each download | |
| SHA-256 | Decrypted stealer payload | |
| SHA-256 | Decrypted stealer payload | |
| SHA-256 | Decrypted stealer payload | |
| SHA-256 | Decrypted stealer payload |
- DomainHosted the subdomain the sponsored ad pointed to
- DomainFinger server whose .plan file holds the first script
- DomainDelivers timer6 and the Doina payload, and Doina’s command server
- DomainHosts the Node.js and stealer package
- DomainHosts stealer packages and is embedded in the stealer
- DomainStealer’s first check-in
- DomainReceives stolen data
- DomainReceives stolen data
- DomainCommand server and payload delivery, per Huntress
- URLtimer6 delivery
- URLEncrypted Doina payload
- URLNode.js package download
- URLNode.js and stealer package download
- URLmacOS payload, offline when Huntress checked
- IP addressNetSupport command server on port 725, also hosts a legitimate restaurant site
- URLNetSupport command path
- SHA-256timer6 script
- SHA-256Decrypted v6 payload, which Huntress identifies as Doina
- SHA-256Malicious index.js
- SHA-256Node.js package zip file, whose hash changes with each download
- SHA-256Decrypted stealer payload
- SHA-256Decrypted stealer payload
- SHA-256Decrypted stealer payload
- SHA-256Decrypted stealer payload
Sources
- Huntress researchPrimary source huntress.com