THIS ISN'T NEW FOR US.

Huntress started in 2015 when three former NSA operators got tired of watching attackers slip past tools that only look for what they already know. We built a SOC instead, one that hunts for what automation misses, on every endpoint and identity we protect.

While I do love seeing an adversary wreck themselves, tradecraft like this keeps hitting businesses more and more often. My team writes up what we're catching most days of the week.

Someone on your team searches “amazon business” and clicks the top sponsored result. The login page looks like Amazon, and they type in their email. One “I’m not a robot” button later, they’ve pasted a command into the Windows Run box because the page told them to.

Here’s our read: ClickFix works because the page asks politely and most people have never been told that no real CAPTCHA asks you to run a command.

We keep seeing the same move, most recently as a sponsored result for installing Claude on a Mac and a ChatGPT Custom GPT. The lure changes and the ask stays the same.

– Jamie Levy

P.S. Curious what sloppy tradecraft actually looks like? We keep a running library of real breaches our SOC has stopped →