Huntress
Day 1 after signup
What hackers run into when they hit Huntress
Real intrusions. Real receipts.
Why it works
- Open with a clear point of view, then establish why the sender has relevant experience before presenting the example.
- Make the threat concrete with a brief scenario, then explain the tactic in plain language so readers can apply the lesson.
- Keep the main research link near the start and offer a related resource at the end for readers who want to explore further.
How it is built
- Opening positioning
- Company research context
- Primary research CTA
- Attack scenario
Email copy
THIS ISN'T NEW FOR US. Huntress started in 2015 when three former NSA operators got tired of watching attackers slip past tools that only look for what they already know. We built a SOC instead, one that hunts for what automation misses, on every endpoint and identity we protect. While I do love seeing an adversary wreck themselves, tradecraft like this keeps hitting businesses more and more often. My team writes up what we're catching most days of the week. SEE WHAT WE'RE SEEING Someone on your team searches “amazon business” and clicks the top sponsored result. The login page looks like Amazon, and they type in their email. One “I’m not a robot” button later, they’ve pasted a command into the Windows Run box because the page told them to. Here’s our read: ClickFix works because the page asks politely and most people have never been told that no real CAPTCHA asks you to run a command. We keep seeing the same move, most recently as a sponsored result for installing Claude on a Mac and a ChatGPT Custom GPT. The lure changes and the ask stays the same. – Jamie Levy P.S. Curious what sloppy tradecraft actually looks like? We keep a running library of real breaches our SOC has stopped → Unsubscribe | Manage Preferences Huntress Labs Inc., 6996 Columbia Gateway Drive, Ste. 101, Columbia, MD,21046 USA 833-HUNT-NOW © 2026 Huntress. All Rights Reserved.