SloppyRAT ClickFix finger.exe LotL payload staging via TCP port 79

Ibrahim Saud@tektrix

•updated Sep 19, 2026•0•0•2

Detects outbound network activity on TCP port 79 (finger) initiated by a client to the domain 'finger.linked4x.com'. This behavior is associated with the SloppyRAT 'ClickFix' campaign, where attackers use social engineering to trick users into executing commands, leading to payload staging and tool retrieval.