Loading story…
A new wave of social engineering attacks, known as ClickFix, is exploiting the legacy Windows utility finger.exe to deliver malware to victims. Attackers use fake CAPTCHA verification pages to trick users into executing scripts that invoke the finger command, which then contacts attacker-controlled servers over TCP port 79. The servers respond with malicious payloads, often in the form of Base64-encoded PowerShell commands, enabling further compromise of the victim's system. This technique is notable for its abuse of the rarely monitored finger protocol, allowing attackers to bypass some security controls.
Two prominent campaigns, KongTuke and SmartApeSG, have been observed using this method since at least November 2025. Both campaigns employ similar tactics, leveraging deceptive web pages to initiate the attack chain and using the finger protocol to retrieve and execute malicious scripts. Security researchers have tracked these campaigns and highlighted the continued effectiveness of this approach, especially in environments where legacy protocols like finger are not adequately secured or monitored.
Get the infrastructure and lures behind it.
2 events from the most recent confirmed update back to the earliest known activity.
By December 2025, researchers analyzing the campaigns confirmed the multi-stage infection chain, including Base64-encoded PowerShell and follow-on malware downloads, and noted that the attacks were still active against networks that do not explicitly block TCP port 79.
Since November 2025, active ClickFix social-engineering campaigns including KongTuke and SmartApeSG have used fake CAPTCHA pages to trick Windows users into running finger.exe commands that retrieve malicious payloads over the legacy finger protocol on TCP port 79.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors have revived the use of the decades-old `finger` command to facilitate remote command execution in a series of ClickFix malware attacks targeting Windows systems. Researchers identified batch files and attack chains where the `finger` command is used to fetch and execute commands from remote servers, often by piping the output directly into `cmd.exe`. These campaigns have been observed leveraging social engineering, such as impersonating Captcha verification prompts, to trick users into running malicious commands that initiate the attack sequence. The sophistication of recent attacks has increased, with malware actively checking for the presence of analysis tools like WinDump, Procmon, and Fiddler before proceeding. If no analysis tools are detected, the malware downloads a ZIP archive containing a NetSupport Manager RAT payload disguised as a PDF. Security experts recommend blocking outgoing traffic to TCP port 79 to mitigate this threat, as the Finger protocol operates over this port and is rarely used for legitimate purposes today.
Jun 29, 2026
Security researchers reported multiple active campaigns using **ClickFix** social engineering—fake error dialogs or verification prompts that trick users into manually running attacker-supplied commands—to bypass browser and download protections and establish an initial foothold. In one enterprise case investigated by **CERT Polska (cert.pl)**, victims were lured via compromised websites showing a fake CAPTCHA/“fix” prompt that instructed them to paste and run a **PowerShell** command via `Win+R`; the script then downloaded a dropper and enabled rapid follow-on activity that can scale to **enterprise-wide compromise**, including deployment of secondary malware such as **Latrodectus** and **Supper** for data theft, lateral movement, and potential ransomware staging. A separate ClickFix operation targeted **macOS developers** by cloning the *Homebrew* site on typosquatted infrastructure; the “install” command was subtly altered to fetch content from `raw.homabrews.org` instead of `raw.githubusercontent.com`, leading to **Cuckoo Stealer** deployment and credential harvesting via repeated password prompts using macOS Directory Services, with related domains tied to shared hosting at **`5.255.123.244`**. ClickFix was also observed as the initial execution mechanism for the resurfaced **Matanbuchus 3.0** MaaS loader, which uses deceptive copy/paste prompts and **silent MSI** execution (via `msiexec`) to deliver a new payload, **AstarionRAT**, enabling capabilities including credential theft and **SOCKS5** proxying; operators were reported to move laterally quickly (including toward domain controllers), consistent with ransomware or data-exfiltration objectives.
Jul 2, 2026
Cybercriminals are leveraging social engineering techniques known as ClickFix and its new variant, FileFix, to trick users into executing malicious commands on their Windows systems. The ClickFix method involves compromised websites displaying fake CAPTCHA-style pages that prompt users to "verify you are human." When users interact with these pages, malicious content is injected into their clipboard, and they are instructed to paste and run this content via the Windows Run dialog, leading to the installation of remote access tools such as NetSupport RAT. The SmartApeSG campaign is one example actively using this approach, with infection chains triggered under specific conditions on compromised sites. The FileFix variation, recently observed in the wild, shifts the attack vector by instructing users to paste malicious commands into the Windows File Explorer address bar instead of the Run dialog. This subtle change exploits user familiarity with File Explorer, making the attack less suspicious and increasing the likelihood of success. Both techniques rely on phishing emails or fake service pages to lure victims, and the end goal is typically the deployment of remote access malware. Security teams should be aware of these evolving tactics and educate users about the risks of following unsolicited instructions involving system dialogs or file paths.
Jun 29, 2026