Threat Intelligence

Old Windows 'Finger' Tool Abused in New ClickFix Attack Delivering Lumma Stealer

Dark Reading · 21 Oct 2026

Key Takeaway Train staff to treat any CAPTCHA or website prompt that asks them to run commands or follow unusual steps on their computer as a red flag, and to report it to IT straight away.

A new ClickFix-style attack is turning an old Windows tool into a way to deliver malware. According to Dark Reading, the campaign relies on malicious Google search results related to Amazon to draw people in.

The attack makes use of the 'finger' utility, a decades-old feature of Windows, to launch a fake CAPTCHA. The CAPTCHA is not a genuine security check. Instead, it is used to get the victim to take steps that result in malware being installed on their device. The malware delivered includes the Lumma stealer, a type of software designed to steal information.

This campaign shows how attackers combine familiar brand names, search engine results and built-in system tools to make their activity look routine. Because the tools involved are part of Windows itself, the activity may not look suspicious at first glance. The source summary does not give further technical detail, so businesses should treat this as an early warning about the technique rather than a full picture of the threat.

ClickFix Lumma stealer Windows malicious search results social engineering

Summarised by CISO AI from Dark Reading, written with Claude Sonnet 5.5. We link back to every original so you can read it yourself.