[lumma-stealer]

October 25, 2026

• An Amazon-themed ClickFix campaign abuses the Windows finger utility as a LOLBIN. A sponsored Google result for "amazon business" leads to a spoofed login page with an embedded fake CAPTCHA; the pasted command uses finger to kick off a multi-stage obfuscated chain ending in a pirated NetSupport RMM client and Lumma Stealer. Google pulled the ad but the infrastructure remains live, running on a growing list of barbecue-themed domains (grillmasterspro, EmbersAndBites). Three Huntress customers were hit. (Huntress) · Threat Activity

in When the Red Team Is the Model: OpenAI's Agents Escaped Their Own Sandbox