According to Dark Reading, the attack begins with malicious Google search results tied to Amazon. Users who click through land on a page that abuses the Windows finger utility, a networking command that has existed for decades, to launch a ClickFix CAPTCHA. The CAPTCHA is the vehicle for delivering the Lumma stealer, an information-stealing malware.
The ClickFix technique relies on social engineering: the user believes they are verifying that they are human, but their action actually triggers the malicious payload. In this campaign, that action is linked to the legacy finger command, which is a trusted, built-in Windows component. This makes the attack stand out less, since it does not rely on unusual script files or macros.
The report highlights how older system utilities can be repurposed for modern malware distribution. The combination of search engine manipulation and CAPTCHA-based deception shows how attackers continue to evolve their methods while reusing parts of the operating system that defensive tools may overlook.