{"id":9191,"date":"2025-12-14T04:03:30","date_gmt":"2025-12-14T04:03:30","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2025\/12\/14\/32566\/"},"modified":"2025-12-14T04:03:30","modified_gmt":"2025-12-14T04:03:30","slug":"32566","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2025\/12\/14\/32566\/","title":{"rendered":"ClickFix Attacks Still Using the Finger, (Sat, Dec 13th)"},"content":{"rendered":"

ClickFix Attacks Still Using the Finger, (Sat, Dec 13th)
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

Introduction<\/strong><\/em><\/p>\n

Since as early as November 2025, the finger<\/a> protocol has been used in ClickFix<\/a> social engineering attacks. BleepingComputer posted a report of this activity on November 15th<\/a>, and Didier Stevens posted a short follow-up in an ISC diary<\/a> the next day.<\/p>\n

I often investigate two campaigns that employ ClickFix attacks: KongTuke<\/a> and SmartApeSG<\/a>. When I checked earlier this week on Thursday, December 11th, both campaigns used commands that ran finger.exe<\/span> in Windows to retrieve malicious content.<\/p>\n

So after nearly a month, ClickFix attacks are still giving us the finger.<\/p>\n

\"\"<\/a>
\nShown above: ClickFix attacks running finger.exe<\/span>.<\/em><\/p>\n

KongTuke Example<\/strong><\/em><\/p>\n

My investigation of KongTuke activity on December 11th revealed a command for finger gcaptcha@captchaver[.]top<\/span> from the fake CAPTCHA page.<\/p>\n

\"\"<\/a>
\nShown above: Example of fake CAPTCHA page from the KongTuke campaign on December 11th, 2025.<\/em><\/p>\n

I recorded network traffic generated by running this ClickFix script, and I used the finger<\/span> filter in Wireshark to find finger traffic over TCP port 79.<\/p>\n

\"\"<\/a>
\nShown above: Finding finger traffic using the finger<\/span> filter in Wireshark.<\/em><\/p>\n

Following the TCP stream of this traffic revealed text returned from the server. The result was a powershell<\/span> command with Base64 encoded text.<\/p>\n

\"\"<\/a>
\nShown above: Text returned from the server in response to the finger<\/span> command.<\/em><\/p>\n

SmartApeSG Example<\/strong><\/em><\/p>\n

My investigation of SmartApeSG activity on December 11th revealed a command for finger Galo@91.193.19[.]108<\/span> from the fake CAPTCHA page.<\/p>\n

\"\"<\/a>
\nShown above: Example of fake CAPTCHA page from the SmartApeSG campaign on December 11th, 2025.<\/em><\/p>\n

I recorded network traffic generated by running this ClickFix script, and I used the finger<\/span> filter in Wireshark to find finger traffic over TCP port 79.<\/p>\n

\"\"<\/a>
\nShown above: Finding finger traffic using the finger<\/span> filter in Wireshark.<\/em><\/p>\n

Following the TCP stream of this traffic revealed text returned from the server. The result was a script to retrieve content from pmidpils[.]com\/yhb.jpg<\/span> then save and run that content on the user’s Windows host.<\/p>\n

\"\"<\/a>
\nShown above: Text returned from the server in response to the finger<\/span> command.<\/em><\/p>\n

Final Words<\/strong><\/em><\/p>\n

As Didier Stevens noted in last month’s diary<\/a> about this activity, corporate environments with an explicit proxy will block TCP port 79 traffic generated by finger.exe<\/span>. However, if TCP port 79 traffic isn’t blocked, these attacks could still be effective.<\/p>\n

Bradley Duncan
\nbrad [at] malware-traffic-analysis.net<\/p>\n

(c) SANS Internet Storm Center. https:\/\/isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.<\/p><\/div>\n

\t

\n
<\/BR><\/p>\n

\t

\n
<\/BR>
\nGo to isc.sans.edu<\/a>
\n \t

\n
<\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"

ClickFix Attacks Still Using the Finger, (Sat, Dec 13th) Introduction Since as early as November 2025, the finger protocol has been used in ClickFix social engineering attacks. BleepingComputer posted a report of this activity on November 15th, and Didier Stevens posted a short follow-up in an ISC diary the next day. I often investigate two […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[56],"tags":[69],"class_list":["post-9191","post","type-post","status-publish","format-standard","hentry","category-isc-sans-edu","tag-isc-sans-edu"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/9191"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=9191"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/9191\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=9191"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=9191"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=9191"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}