Amazon-Themed ClickFix Campaign Serves Up Finger-Licking Malware
Comments on “Amazon-Themed ClickFix Campaign Serves Up Finger-Licking Malware”
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
Huntress researchers documented an Amazon-themed ClickFix campaign that lured victims via a sponsored Google result to a spoofed Amazon login page, then tricked them into pasting a concealed command into the Windows Run dialog.
Why it ranked
No. 21 of 110 with a score of 0.69. The panel rated it highest on technical depth (0.94) and substantiated (0.91), lowest on significance (0.60). Placed No. 21, No. 12 by score alone: the tenth Security story of the day (−0.080). The placement terms move stories; they are not part of the score.
- AI judgeJudge 2claude-haiku-5-5
- Detailed, well-evidenced malware investigation with IOCs and reverse-engineering of a ClickFix chain; strongly security-focused, practically useful for defenders, though a single campaign with moderate broad significance.
- AI judgeJudge 3gpt-5.6-luna
- Detailed reverse engineering of a multi-stage ClickFix campaign, including finger-based delivery, obfuscation, loaders, infostealers, RMM abuse, network behavior, and actionable IOCs. It is highly relevant and substantiated, with modest vendor-product promotion.
Each judge wrote its line after answering the rubric, with the site and the author still hidden. Every answer behind this is in the table under Score.
Score
0.69total under rubric v2.3
- Significance0.60
- Reader interest0.81
- Audience breadth0.67
- Practical relevance0.73
- Substantiated0.91
- Technical depth0.94
- New information0.85
- Counts against: Promotional0.16
- Counts against: Overclaim0.18
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| SignificanceHow much does this change what people in tech know or can do? | 0.59 | 0.50 | 0.72 | 0.60 | 0.22 | +0.24 | +0.145 |
| Reader interestWould a well-informed senior engineer or tech founder want to read this today, and likely pass it on? | 0.73 | 0.80 | 0.91 | 0.81 | 0.18 | +0.26 | +0.211 |
| Audience breadthHow many people who build technology does it concern? | 0.73 | 0.67 | 0.62 | 0.67 | 0.11 | +0.13 | +0.088 |
| Practical relevanceHow useful is it to someone who builds software or tech products? | 0.64 | 0.75 | 0.82 | 0.73 | 0.18 | +0.22 | +0.162 |
| SubstantiatedHow well is it backed? Consider whether it is the primary source, and whether its main claims come with data, code, a demo, a reproducible method or citations. | 0.93 | 0.90 | 0.90 | 0.91 | 0.03 | +0.05 | +0.046 |
| Technical depthHow technically substantive is it? | 0.99 | 0.90 | 0.92 | 0.94 | 0.10 | +0.05 | +0.047 |
| New informationDoes it contain information absent from the stories covered in the last 7 days (list provided)? | 0.91 | 0.70 | 0.94 | 0.85 | 0.24 | +0.05 | +0.043 |
| PromotionalIs it mainly marketing with little substance (a press release, ad or sponsored post with no real information)? A launch post that carries real news is not promotional. | 0.06 | 0.10 | 0.32 | 0.16 | 0.26 | −0.19 | −0.030 |
| OverclaimDo the headline or conclusions claim more than the body supports? | 0.31 | 0.15 | 0.08 | 0.18 | 0.23 | −0.11 | −0.020 |
| Sum of contributions | +0.691 | ||||||
| Claim-check penalty | 0.000 | ||||||
| Total, as published | 0.691 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
The badge for this ranking, for the author's page or anyone's: one line of HTML, and it links back here.
<a href="https://rubric.hrih.si/editions/2026-10-29/21/"><img src="https://rubric.hrih.si/badge/2026-10-29/21.svg" alt="Ranked #21 on Rubric, 29 Oct 2026" width="245" height="28"></a>Claim check
Claim check: 1 matches source · 3 no source given · 4 couldn’t check. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
No source givenNumber
The ClickFix-style attack using the finger utility has already struck at least three Huntress customers.
The article gives no link or citation for it.
The article says “an attack method that has already struck at least three Huntress customers”
The source says No source to compare with.
Couldn’t checkDate
Threat actors have been abusing the finger utility in ClickFix attacks for at least a year.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “Threat actors have been abusing the finger utility, which (although present on most modern computers) is not well understood by most computer users, in ClickFix attacks for at least a…”
The source says No passage could be compared.
Source cited by the article: bleepingcomputer.com/news/security/decades-old-finger-protocol-abused-in-clickfix-malware-attacks
Couldn’t checkDate
The finger protocol predates the existence of the web by nearly two decades.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “predating the existence of the web itself by nearly two decades”
The source says No passage could be compared.
Source cited by the article: en.wikipedia.org/wiki/Finger_(protocol)
Matches sourceQuote
Security vendors identify the v6 malware as Doina, and Halcyon reported in 2024 that Doina was implicated as a precursor step to ransomware attacks.
The cited source says the same thing.
The article says “In 2024, security vendor Halcyon reported that Doina was implicated as a precursor step to ransomware attacks”
The source says “Halcyon detected an array of Trojans that may be precursors to ransomware payloads”
Source cited by the article: halcyon.ai/blog/halcyon-threat-insights-004-april-2024
Couldn’t checkGeneralization
The larger decrypted file is allegedly Lumma Stealer, as identified via the VirusTotal analysis.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “The larger file is an infostealer malware, allegedly Lumma Stealer”
The source says No passage could be compared.
Source cited by the article: virustotal.com/gui/file/24a293a662600b2292d9259baebba1c09b41df82a5c9c20f8572625ae759696f
Couldn’t checkGeneralization
Several vendors believe timer6 uses the deprecated Veil adversary simulation framework; Huntress says timer6 uses some aspects of Veil's shellcode_inject/flat.py but also strays from Veil's default behavior.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “Several cybersecurity vendors appear to believe that timer6 leverages a now-deprecated adversary simulation framework called Veil”
The source says No passage could be compared.
Source cited by the article: virustotal.com/gui/file/d864b28c302db9ed10baf8def0fb26bac0b97d27349d22c4e9390d30fce54649
No source givenNumber
The pirated NetSupport RMM's license and copyright information indicate it is at least eight years old.
The article gives no link or citation for it.
The article says “The license key and copyright information for this RMM indicate the RMM is at least eight years old”
The source says No source to compare with.
No source givenNumber
ClickFix accounted for about 2.2% of Huntress Managed EDR detection signals this year, and nearly 99% of those detections were high severity.
The article gives no link or citation for it.
The article says “ClickFix accounted for about 2.2% of the Managed Endpoint Detection and Response (EDR) detection signals Huntress has seen this year so far, but nearly 99% of those detections were high…”
The source says No source to compare with.
Also covered by
No other coverage was clustered with this story.
Elsewhere
Elsewhere: HN 1 pts, not on front page
Recorded for context only, checked 29 Oct 2026, 05:47 UTC. It played no part in the ranking.