Huntress Reports ClickFix Attacks Surge 2,048%, Introduces Real-Time User Training Intervention
Huntress published a blog post detailing trends observed by its Security Operations Center (SOC) around ClickFix social-engineering attacks and announcing a new product feature called Defense Drill Interventions. The SOC found that of over 25,000 hosts showing a ClickFix signal, 29% involved users falling for the same attack more than once, even after the initial attempt was blocked by Managed EDR's Attack Disruption engine. The post also cites a 1,380% increase in device code phishing following the Railway incident and a 2,048% growth in ClickFix incidents between 2025 and 2026, noting ClickFix was responsible for more than half of all malware loader activity in 2025. The announcement centers on a new capability that pairs real-time attack disruption with just-in-time security awareness training delivered directly to the compromised user.
Detalhes técnicos
When Managed EDR's Attack Disruption blocks a ClickFix attack (commonly used to deliver infostealers and RATs via fake CAPTCHA/verification prompts tricking users into running malicious commands), the user is immediately shown a "Defense Drill" — a short, hands-on training module simulating the specific tradecraft just observed, including a "Defense Coach" highlighting indicators of compromise to watch for. The feature is built on the Huntress Agentic Platform and is being piloted first against ClickFix, with plans to expand to other threats such as device code phishing (as seen in the Railway incident) and attacks delivered via tools like custom ChatGPT-based lures.
Remediação
Huntress recommends organizations deploy Managed EDR with Attack Disruption alongside Managed Security Awareness Training (SAT) to combine automated blocking with immediate, contextual user education, reducing repeat incidents caused by the same user falling for identical lures multiple times.
Linha do tempo
-
Huntress Reports ClickFix Attacks Surge 2,048%, Introduces Real-Time User Training Intervention
ler a análise desta fonte ocultar
Huntress published a blog post detailing trends observed by its Security Operations Center (SOC) around ClickFix social-engineering attacks and announcing a new product feature called Defense Drill Interventions. The SOC found that of over 25,000 hosts showing a ClickFix signal, 29% involved users falling for the same attack more than once, even after the initial attempt was blocked by Managed EDR's Attack Disruption engine. The post also cites a 1,380% increase in device code phishing following the Railway incident and a 2,048% growth in ClickFix incidents between 2025 and 2026, noting ClickFix was responsible for more than half of all malware loader activity in 2025. The announcement centers on a new capability that pairs real-time attack disruption with just-in-time security awareness training delivered directly to the compromised user.
Technical Details
When Managed EDR's Attack Disruption blocks a ClickFix attack (commonly used to deliver infostealers and RATs via fake CAPTCHA/verification prompts tricking users into running malicious commands), the user is immediately shown a "Defense Drill" — a short, hands-on training module simulating the specific tradecraft just observed, including a "Defense Coach" highlighting indicators of compromise to watch for. The feature is built on the Huntress Agentic Platform and is being piloted first against ClickFix, with plans to expand to other threats such as device code phishing (as seen in the Railway incident) and attacks delivered via tools like custom ChatGPT-based lures.
Remediation
Huntress recommends organizations deploy Managed EDR with Attack Disruption alongside Managed Security Awareness Training (SAT) to combine automated blocking with immediate, contextual user education, reducing repeat incidents caused by the same user falling for identical lures multiple times.