huntress

Rapid Response: php2shell, Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619)

Deception is moving at machine speed. Learn to keep pace. On October 20, details of two critical remote code execution (RCE) vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, leaked online ...
huntress

Amazon-Themed ClickFix Campaign Serves Up Finger-Licking Malware

Deception is moving at machine speed. Learn to keep pace. Huntress investigated multiple incidents stemming from an Amazon-themed ClickFix campaign tied to a sponsored Google search result for the ...
huntress

Introducing ITDR Lookback: Find Out Who Was in Your Microsoft 365 Tenant Before You Were

Deception is moving at machine speed. Learn to keep pace. Today, Huntress Managed ITDR's Lookback feature is generally available for newly onboarded Microsoft 365 tenants. Lookback automatically ...
huntress

ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks

Deception is moving at machine speed. Learn to keep pace. Huntress is Free for Internal Use for MSPs. Start a Trial then book time with us to get the licenses assigned. A Microsoft 365 credential (API ...
huntress

The Not So Silent Miner: Threat Actor Compiles Cryptominer on the Endpoint

Deception is moving at machine speed. Learn to keep pace. Huntress recently observed a threat actor doing something unique post-compromise: instead of simply dropping a miner, they compiled one ...
huntress

The Tale of Two INC Ransom Notes

Deception is moving at machine speed. Learn to keep pace. In late August, the Huntress agent was installed on an organization after an incident involving the INC ransomware. Typically, this would ...
huntress

Google Doc Sidebar Sends Mac and Windows Users Down Different Paths to Malware

Deception is moving at machine speed. Learn to keep pace. Many Black Hat and DEFCON attendees come home to an inbox full of DMs. While catching up on the expected post-conference networking last month ...
huntress

The AI Attack Surface: How Threat Actors Abuse Trusted AI Platforms

Deception is moving at machine speed. Learn to keep pace. As more people use AI models such as Claude, ChatGPT, Grok, and Gemini, threat actors are abusing trusted AI platforms in a variety of ways to ...
huntress

How a Google Search for Claude Led to MacSync

Deception is moving at machine speed. Learn to keep pace. Picture this: You've just unboxed a shiny new Macbook, and now you're downloading all of your favorite apps ...
huntress

Akira Hits Safe Mode: Ransomware Rebooting Around EDR

Deception is moving at machine speed. Learn to keep pace. After gaining access via an exposed SonicWall VPN, an Akira affiliate rebooted the victim host into Safe Mode with Networking to defeat EDR, a ...
huntress

What Our AI SOC Analyst Can Do (and What We Won’t Let It Do)

Deception is moving at machine speed. Learn to keep pace. If you're evaluating AI use in your security stack, you should ask yourself, "What's it allowed to do, and who owns the guardrails?" At ...
huntress

Custom HTML for Custom Phishing: Make the Fake Feel Real

Deception is moving at machine speed. Learn to keep pace. It happens all the time in Business Email Compromise (BEC) attacks: someone in the finance department gets an invoice email from what looks ...