Summary
- Attackers used sponsored Google results and a fraudulent Amazon Business page to deliver a ClickFix prompt.
- Huntress observed a Windows infection chain involving the finger utility, information-stealing malware and an unauthorised NetSupport remote access client.
- At least three Huntress customers were affected; UK and European exposure is plausible through Amazon Business's operations, but local victims are unconfirmed.
A malicious Google search advertisement impersonating Amazon Business has been used to deliver information-stealing malware and unauthorised remote access software, according to an investigation published by cybersecurity company Huntress.
The attackers placed a sponsored result against searches for Amazon Business, directing visitors to a fraudulent sign-in page and then a fake CAPTCHA that instructed them to execute a command on their computers.
Huntress investigated incidents involving at least three of its customers and reconstructed a Windows infection chain involving a legitimate operating system utility, several malware components and an unauthorised installation of NetSupport remote management software.
Google has removed the malicious advertisement, but Huntress said associated attacker infrastructure remained operational when its research was published on 21 October.
The campaign targets a familiar business purchasing service rather than an obscure download destination. Amazon Business operates in the UK and across several European markets, making the impersonated service relevant to organisations using digital procurement.
Huntress did not disclose the countries in which its affected customers were located, and its investigation does not establish a confirmed UK or European infection.
Sponsored search result led to a false verification process
The initial advertisement appeared among paid results for the search term associated with Amazon Business.
Instead of leading directly to the legitimate purchasing service, the link passed through attacker-controlled infrastructure and reached a counterfeit Amazon sign-in page hosted through Google Sites.
The fraudulent page first requested an email address or telephone number, reproducing the initial step of a familiar account authentication process.
It then presented a fake CAPTCHA containing an instruction intended to make the visitor run a command outside the browser.
The command was placed on the clipboard when the visitor interacted with the false verification prompt. On Windows, the page instructed the visitor to execute it using the operating system’s Run interface.
This technique, known as ClickFix, relies on social engineering rather than a newly discovered browser vulnerability.
The attacker persuades the person using the device to initiate an operation that a website would not ordinarily have permission to perform directly.
The apparent verification step provides a pretext for the action, while the actual command may contain instructions that are not apparent from the page displayed to the user.
Because the malicious activity begins outside the browser, the attack can bypass some of the normal expectations associated with scanning downloaded files or assessing website content.
Attack chain abused a legitimate Windows utility
Huntress found that the Windows command used the finger utility, a longstanding networking tool that can communicate with remote services.
In ordinary use, the utility is not malicious. The attackers repurposed it to retrieve content from their infrastructure and initiate further stages of the infection process.
The investigation identified multiple components designed to load additional software, gather sensitive information and establish remote access.
Among the observed payloads were Doina malware, Lumma Stealer and an unauthorised copy of the NetSupport Client remote monitoring application.
These components serve different purposes. A loader can retrieve or launch subsequent stages, while an information stealer can collect data associated with accounts and applications.
Remote management software can allow a third party to interact with an infected computer after installation and configuration.
Such applications are widely used for legitimate technical support. Their presence becomes a security concern when they arrive without authorisation and are controlled through infrastructure associated with an attacker.
The campaign demonstrates how malicious activity can be concealed among familiar software components. The trustworthiness of a signed executable or recognised utility does not establish that the process invoking it is legitimate.
Investigators must instead establish how the software was installed, which process initiated it and whether its communications and privileges were authorised.
Credential exposure could extend into business systems
Huntress’s malware analysis identified capabilities directed towards browser information, account credentials and cryptocurrency wallet applications.
These capabilities describe the information that the malicious components could target; they do not establish that every affected customer suffered successful theft of every category of data.
For a business device, the relevant exposure may extend beyond an individual shopping account. Browsers can contain active sessions, stored credentials and access to other applications used by the employee.
If an attacker obtains usable credentials or remote access to a device, the subsequent consequences depend on the affected accounts, their permissions and the organisation’s identity controls.
A purchasing employee may have access to corporate procurement records, supplier interactions and approval systems, while other applications on the same device may serve entirely different business functions.
Compromising the device therefore cannot be assumed to compromise every connected service, but it creates a route through which an attacker may attempt further access.
The association with Amazon Business is especially relevant because the legitimate service is used by organisations in the UK and Europe, including companies managing purchasing through centralised business accounts.
However, the available investigation does not show that the malicious advertisement was displayed to users in every country where Amazon Business operates.
The verified finding is an active business-themed advertising campaign capable of affecting users who encountered the malicious placement, not a confirmed breach of Amazon’s own platform or a geographically established set of European victims.
Mac instructions were observed without a confirmed infection
The fraudulent verification page also adapted its instructions for visitors whose browsers identified the device as running macOS.
Instead of presenting the Windows execution process, it instructed those visitors to run a script using the Mac Terminal application.
Huntress found that the associated destination was unavailable during its investigation. Its detailed analysis therefore establishes a working Windows infection chain, while the effectiveness and deployment of the separate macOS route remain unconfirmed.
The existence of alternative instructions indicates that the attackers attempted to accommodate more than one operating system, but it does not establish successful infections across both platforms.
Huntress also documented multiple related domains and infrastructure components associated with the Windows malware chain.
Although Google removed the sponsored advertisement, researchers said the attacker-controlled systems they had traced were still functioning when the findings were published.
Removing one paid search placement can reduce exposure through that route without disabling every malicious website, payload distribution service or remote access connection already established.
Huntress has published indicators to support investigation of the campaign, including artefacts associated with advertising redirects and the subsequent malware activity. The total number of affected organisations, and whether any were based in the UK or Europe, remains unconfirmed.
