Decades-old ‘Finger’ protocol abused in ClickFix malware attacks

Researchers observed active ClickFix campaigns abusing the Finger protocol (TCP/79) and the Windows finger command as a LOLBIN to fetch and pipe remote commands into cmd.exe; actors used social engineering to trick victims into executing these commands, which download and install payloads (a Python infostealer and NetSupport Manager RAT), perform anti-analysis checks, and establish persistence via scheduled tasks.