Left of Boom: Stop ClickFix and Rogue RMMs Before They Run

Someone searches Google for “Amazon Business” and clicks the top result, which is an ad. The page looks like Amazon’s login until a fake CAPTCHA tells them to press two keys and paste something to prove they’re human. Obediently, they do.

The command installs a password stealer and a remote access tool, and because the user runs every step and Windows executes it as designed, it looks like normal activity. This tactic, called ClickFix, was a high severity signal in Huntress EDR nearly 99% of the time we saw it this year.

Most endpoint security today responds after the command has run, so even a fast response leaves your team with an incident to clean up. On December 10, we’re launching a new way to stop these attacks before they start, without getting in the way of legitimate work.

What we’ll cover:

• How attackers use social engineering to turn the tools you rely on against you

• What Early Access showed us about the remote access tools running in real environments, including the ones nobody knew were installed

• A live demo of Huntress Managed Endpoint Security Posture Management (ESPM), from learning mode to blocking, and how it fits alongside your existing detection and response

Join us December 10 for the live demo.