ClickFix Attacks Still Using the Finger, (Sat, Dec 13th)

This report documents active ClickFix social-engineering campaigns (observed Nov–Dec 2025) that misuse the legacy finger protocol (TCP/79) via Windows finger.exe to fetch and execute malicious content — including Base64-encoded PowerShell and files from domains such as pmidpils.com/yhb.jpg. Network captures from KongTuke and SmartApeSG show finger commands returned script content that downloads and runs payloads; environments that block TCP/79 (explicit proxy) can mitigate this technique.