Huntress: 'amazon business' Google ad led to fake Amazon login and ClickFix lure via advancedfences.com subdomain
Security firm Huntress reported on 21 October 2026 that it investigated incidents, affecting at least three customers, from an Amazon-themed ClickFix campaign. The top sponsored Google result for the…
- First reported
- Reports
- 1
Source: huntress.com · published
What happened
Security firm Huntress reported on 21 October 2026 that it investigated incidents, affecting at least three customers, from an Amazon-themed ClickFix campaign. The top sponsored Google result for the search 'amazon business' was hosted on an attacker-controlled domain subdomain, orders-amazon-com.advancedfences.com, which redirected to a fake Amazon sign-in page hosted on Google Sites (sites.google.com/view/ch-pc/sign-in). After a user entered an email or phone number, a fake CAPTCHA copied a command to the clipboard and told the user to paste it into the Windows Run box; macOS users were sent to a URL on ashevilleroofingcontractor.com (Huntress does not say whether that site is attacker-owned or compromised). The command abused the Windows 'finger' utility to contact grillrecipespro.com and started a multi-stage chain that Huntress says installed Doina malware, a version of Lumma Stealer and a pirated NetSupport remote access tool. Huntress lists further attacker infrastructure, mostly barbecue-themed: grillmasterchef.com, thegrilljournal.com, homelygrill.com, perfectgrillrecipes.com, embersandbites.com, kiriosyka.com and liokida.com, plus NetSupport C2 IP 167.148.201.106, which Huntress says otherwise hosts only a legitimate Detroit restaurant's website (that site was not observed being abused). Google removed the ad, but Huntress says the infrastructure remained online. Amazon and Google are spoofed or abused brands, not the operators.
How the scam works
Huntress explains that the fake CAPTCHA copied a command to the clipboard and told the victim to press Windows+R, paste and press Enter. The command was padded so that the Run box appeared to show only an innocent instruction to 'Push the Enter key'. The finger utility then fetched a hidden script from a .plan file on grillrecipespro.com, starting a chain that ran IronPython from GitHub, retrieved a further script from grillmasterchef.com using Cyrillic character substitution to dodge detection, and installed the Doina loader. A 52 MB Node.js package from kiriosyka.com was used to inject Lumma Stealer, which targets browser data, crypto wallets including Ledger, Electrum and Atomic, password managers and email clients. A pirated copy of NetSupport, at least eight years old, was also installed for remote access.
Huntress stresses that no genuine CAPTCHA ever asks you to paste commands into Windows Run, PowerShell or Terminal. It says organisations can look for Google ad tracking markers such as 'aclk' and 'gclid' in browser history to trace how users reached such pages, and can block the finger utility if it isn't needed. The macOS URL was offline when Huntress checked.
Source
Huntress, research on an Amazon-themed ClickFix campaign by Andrew Brandt and Sarah Reddish (published 21 October 2026).
Red flags
- A sponsored search result that leads to a sign-in page on an unrelated domain or Google Sites.
- A CAPTCHA that asks you to press Windows+R, paste and press Enter.
- Any page telling you to paste a command into Run, PowerShell or Terminal.
- A login page for a big brand that isn't on that brand's own domain.
If you were targeted
- 1Never paste commands from a website into Windows Run, PowerShell or Terminal.
- 2Type amazon.com yourself or use a bookmark rather than clicking search ads.
- 3If you ran the command, disconnect the computer from the network and have it checked or rebuilt.
- 4From a clean device, change passwords saved in browsers and password managers, and move crypto from affected wallets.
- 5Organisations: block or monitor the finger utility and hunt for the listed domains and IP address.