Back isc.sans.edu

Finger.exe & ClickFix

isc.sans.edu • August 18, 2026

finger is a very old UNIX command, that was converted to a Windows executable years ago, and is part of Windows since then.

In the ClickFix attacks, it is used to retrieve a malicious script via the finger protocol.

We wrote finger.exe 3 years ago: " Finger.exe LOLBin ".

What you need to know:

So if you are in a corporate environment with an explicit proxy (and blocking all Internet facing communication that doesn't go through the proxy), the finger.exe command won't be able to communicate.

And if you have a transparent proxy, finger.exe will be able to communicate provided the proxy allows TCP connections to port 79.

Didier Stevens Senior handler blog.DidierStevens.com

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Exploitation of Windows Finger Command for Malicious File Transfers Security researchers have identified that the Windows finger.exe command can be exploited to download or steal files, functioning as a living-off-the-land binary (LoLBin). Discovered by John Page, this vulnerability allows attackers to use finger.exe as a makeshift command and control (C2) server, enabling data exfiltration without detection by Windows Defender. The attack method involves encoding files in Base64 to evade security measures and utilizing Windows NetSh Portproxy to bypass firewall restrictions. Organizations using explicit proxies may be safe, but those with transparent proxies could be vulnerable. The threat is compounded by the growing list of LoLBins in Windows, which includes tools like certutil.exe and desktopimgdownldr.exe. Proof-of-concept scripts have been released to demonstrate the exploit's effectiveness. The potential for widespread impact is significant, especially in environments where security measures are lax. 68

Extracted Entities

Finger.exe & ClickFix

The full story

Extracted Entities

Attack Types (1)

Platforms (2)

Tools (1)