cyber.hendryadrian.com
Security News · huntress.com

Huntress Adds Just-in-Time Training After Blocking ClickFix Attacks

· Original article ↗

Summary

Huntress announced Defense Drill Interventions, which pairs Managed EDR Attack Disruption with just-in-time ClickFix training after a blocked attempt. The company says 29% of more than 25,000 hosts with a ClickFix signal had repeat attempts.

Key points

  • Huntress says 29% of more than 25,000 hosts with a ClickFix signal had multiple attempts.
  • Defense Drill Interventions presents a ClickFix training pop-up when Managed EDR Attack Disruption blocks an attempt.
  • Huntress describes Defense Drills as short, hands-on exercises that simulate emerging threats in a controlled environment and teach users what indicators to look for.
  • The initial intervention focuses on ClickFix; Huntress says managed assignments and breaking-threat drills are planned.
  • Huntress says the feature is intended to address risky user behavior at the time of a detected event, alongside disrupting the attack.

Article Details

Event Type
Huntress introduced Defense Drill Interventions, a just-in-time security-awareness training capability linked to detections and attack disruption.
Impact
For ClickFix incidents, Huntress says Managed EDR Attack Disruption stops the attack and presents the affected user with a related Defense Drill. Huntress reports that, among more than 25,000 hosts with a ClickFix signal, 29% had more than one attempt. The article also reports a 1,380% increase in device code phishing after the Railway incident and a 2,048% increase in ClickFix incidents between 2025 and 2026.

Vendors

HuntressThat's why Huntress is introducing a new way to address real-world risky behaviors as they happen, with contextually relevant, just-in-time training. You'll turn what could've been an incident into a learning

Products

Attack DisruptionYou just had a user fall for a ClickFix attack, but thankfully, Attack Disruption from Managed EDR shut it down before the attacker could launch an infostealer. Now, you'd think this means the threat has been mitigatedDefense Drill InterventionsDefense Drill Interventions: Security Training That Shows Up When the Attack DoesDefense DrillsDefense Drills: from incident to awareness even fasterHuntress Agentic PlatformThis is just the beginning for Defense Drills and Defense Drill Interventions, and we'll continue to build out more interventions within the Huntress Agentic Platform to keep your users and your organization more secure.Huntress platformDrill Interventions is changing that. The combination of Managed SAT with detections from the Huntress Platform is like adding 1+1 and getting 3. It's not bad math; it's added value. It's better security outcomesManaged EDRYou just had a user fall for a ClickFix attack, but thankfully, Attack Disruption from Managed EDR shut it down before the attacker could launch an infostealer. Now, you'd think this means the threat has been mitigatedManaged SATDefense Drill Interventions is changing that. The combination of Managed SAT with detections from the Huntress Platform is like adding 1+1 and getting 3. It's not bad math; it's added value. It's better security

Related Articles