Daily Cybersecurity News - December 14, 2025

ClickFix Attacks: Convergence of Finger Protocol & Cloud Identity Abuse

Executive Summary

Ongoing ClickFix attacks are bifurcating into two distinct streams: endpoint compromise leveraging the Finger protocol (TCP/79) for malware delivery, and identity compromise leveraging ConsentFix to bypass MFA. Blue teams must block outbound Finger traffic and monitor Azure CLI authentication flows, while Red Teams should simulate both payload delivery via legacy protocols and token theft via illicit consent grants.

Key TTPs

Initial Access: Exploiting human error through social engineering, specifically fake "Verification" or "Browser Update" prompts on compromised legitimate websites.
Execution (Endpoint Stream): Tricking users into running finger.exe commands via the Windows Run dialog to bypass firewalls and download scripts.
Execution (Identity Stream): Deceiving users into authenticating via the Microsoft Azure CLI application (ConsentFix) to grant persistent OAuth access.
Defense Evasion: Use of legacy protocols (Finger) to bypass proxy inspection and use of trusted first-party applications (Azure CLI) to evade conditional access policies.

Campaign Analysis

ClickFix attacks have grown in popularity since early 2024, targeting various sectors with evolving techniques. The attacks lead to two primary outcomes: deployment of RATs (like NetSupport) via the Finger protocol , or total account takeover via OAuth token theft.

Targeting & Infrastructure

Target Profile: Broad, with specific recent campaigns targeting Hospitality (Booking.com fraud), Transport/Logistics (fake manifest software), and Healthcare.
Infrastructure: Compromised WordPress sites acting as Traffic Distribution Systems (TDS) and dedicated phishing domains hosting fake CAPTCHA pages. Actionable Intelligence

Relevant Terms

Finger Protocol: A legacy network protocol (TCP/79) exploited to fetch malicious scripts past firewalls that do not inspect non-HTTP traffic.
ConsentFix: A browser-native attack variant that tricks users into granting permissions to the Azure CLI app, allowing attackers to steal OAuth tokens without a password.
ClickFix: The overarching social engineering technique that tricks users into manually executing malicious commands (Paste-and-Run) by posing as legitimate error or verification prompts.

Source: SANS Institute