/
← Voltar ao feed
low

Huntress launches Attack Reduction to block the Windows Run dialog and disrupt ClickFix attacks

1 fonte(s) · 1 atualização(ões) · publicado 21/10/2026 10:00 · coletado há 2 dias

Huntress announced Attack Reduction, a new capability in Huntress Managed ESPM (Early Access) that disables the "Windows key + R" shortcut for users who never use the Run dialog, aiming to break the most common ClickFix attack chain. The post opens with an attempted fake-CAPTCHA lure that targeted a Huntress employee on a spoofed airport spa website; the employee recognized the ruse and did not run the command. Huntress cites its 2026 Cyber Threat Report, which linked ClickFix and fake CAPTCHA scams to over half of malware loader activity, and says Run dialog-based ClickFix now accounts for 31% of its EDR SOC signals. The vendor notes that 90% or more of users in ESPM Early Access never use the Run dialog. This is vendor product news, but it carries useful context on the continued prevalence of ClickFix.

Detalhes técnicos

  • The lure displays a fake CAPTCHA that instructs the user to press Windows key + R and paste (Ctrl + V) a malicious PowerShell command the page silently copied to the clipboard.
  • The command downloads and runs a file that sets up persistence via a registry key, installs a remote access trojan, and steals saved browser passwords, cookies and credit card details.
  • Lures cited include fake Windows Update screens, fake Docker ads, compromised small-business websites and malicious AI chatbots.
  • Attack Reduction builds a per-user baseline of Run dialog history, flags ClickFix-like commands in that history (a reason to investigate, not proof of compromise, since Windows does not record execution time), blocks the shortcut at account or organization level, shows the user a warning pop-up, and records the clipboard contents of blocked attempts.
  • Limitation: attackers already instruct users to paste commands into File Explorer's address bar, Windows Terminal, Command Prompt or PowerShell, so blocking the Run dialog does not stop every variant.
  • Planned controls: Command Prompt restrictions, interactive PowerShell restrictions, Windows ASR rules for Office, script and email apps, and blocking of HTML applications (mshta).

Remediação

  • Disable the Run dialog for users who do not need it, after baselining usage so legitimate workflows are not broken.
  • Layer the control with EDR to catch what gets through and with security awareness training that teaches users a real CAPTCHA never asks them to paste a command.
  • Investigate any ClickFix-like commands found in users' Run history.
  • Watch for ClickFix variants that use File Explorer, Windows Terminal, Command Prompt or PowerShell instead of the Run dialog.

Linha do tempo

  1. huntress.com ↗ · pub. 21/10/2026 10:00 · coletado 21/10 12:01 primeiro registro

    Huntress launches Attack Reduction to block the Windows Run dialog and disrupt ClickFix attacks

    ler a análise desta fonte

    Huntress announced Attack Reduction, a new capability in Huntress Managed ESPM (Early Access) that disables the "Windows key + R" shortcut for users who never use the Run dialog, aiming to break the most common ClickFix attack chain. The post opens with an attempted fake-CAPTCHA lure that targeted a Huntress employee on a spoofed airport spa website; the employee recognized the ruse and did not run the command. Huntress cites its 2026 Cyber Threat Report, which linked ClickFix and fake CAPTCHA scams to over half of malware loader activity, and says Run dialog-based ClickFix now accounts for 31% of its EDR SOC signals. The vendor notes that 90% or more of users in ESPM Early Access never use the Run dialog. This is vendor product news, but it carries useful context on the continued prevalence of ClickFix.

    Technical Details

    • The lure displays a fake CAPTCHA that instructs the user to press Windows key + R and paste (Ctrl + V) a malicious PowerShell command the page silently copied to the clipboard.
    • The command downloads and runs a file that sets up persistence via a registry key, installs a remote access trojan, and steals saved browser passwords, cookies and credit card details.
    • Lures cited include fake Windows Update screens, fake Docker ads, compromised small-business websites and malicious AI chatbots.
    • Attack Reduction builds a per-user baseline of Run dialog history, flags ClickFix-like commands in that history (a reason to investigate, not proof of compromise, since Windows does not record execution time), blocks the shortcut at account or organization level, shows the user a warning pop-up, and records the clipboard contents of blocked attempts.
    • Limitation: attackers already instruct users to paste commands into File Explorer's address bar, Windows Terminal, Command Prompt or PowerShell, so blocking the Run dialog does not stop every variant.
    • Planned controls: Command Prompt restrictions, interactive PowerShell restrictions, Windows ASR rules for Office, script and email apps, and blocking of HTML applications (mshta).

    Remediation

    • Disable the Run dialog for users who do not need it, after baselining usage so legitimate workflows are not broken.
    • Layer the control with EDR to catch what gets through and with security awareness training that teaches users a real CAPTCHA never asks them to paste a command.
    • Investigate any ClickFix-like commands found in users' Run history.
    • Watch for ClickFix variants that use File Explorer, Windows Terminal, Command Prompt or PowerShell instead of the Run dialog.