# Huntress Published articles for Huntress. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Ben Bernstein, Manager of Cybersecurity Advisors at Huntress - Interview Series DevFeed: [Ben Bernstein, Manager of Cybersecurity Advisors at Huntress - Interview Series]() Original publisher: [Read original article]() Author: Antoine Tardif, CEO & Founder of Unite.AI Published: 2026-09-18T19:17:48Z Content type: article Language: en Sources: [Unite.AI]() Topics: [Cybersecurity](), [Security Operations Center](), [software-architecture]() Tags: [cybersecurity](), [edr](), [huntress](), [interview](), [interviews](), [leadership](), [management](), [siem](), [soc]() ### AI overview An interview with Ben Bernstein, Huntress's Manager of Cybersecurity Advisors, covering his career from helpdesk and systems administration to cybersecurity advisory leadership. Bernstein explains how hands-on IT experience, troubleshooting, and understanding normal system behavior inform security work and threat identification. ### Source excerpt Ben Bernstein, Manager of Cybersecurity Advisors at Huntress, is a cybersecurity professional with more than a decade of experience spanning technical support, systems administration, client success, technical account management, and security advisory leadership. He began his career in hands-on IT roles, progressing from helpdesk work to systems administration before moving into account management and client success at Integris. Bernstein later spent three years at Red Canary, where he managed... ## Google Doc Sidebar Sends Mac and Windows Users Down Different Paths to Malware DevFeed: [Google Doc Sidebar Sends Mac and Windows Users Down Different Paths to Malware]() Original publisher: [Read original article]() Author: Susannah Matt; Ryan Dowd; Jonathan Semon Published: 2026-09-15T13:00:00Z Content type: news Language: en Sources: [Huntress Blog]() Topics: [Malware](), [Security](), [Windows](), [macOS](), [PowerShell]() Tags: [huntress](), [mac](), [malware](), [powershell](), [security](), [soc](), [windows]() ### AI overview A Huntress investigation examines how a threat actor used a malicious custom sidebar in a real Google Doc to distribute different malware chains to macOS and Windows users. The reported campaign involved an AMOS infostealer on macOS and a PowerShell-based loader chain on Windows. ### Source excerpt A single X DM split into two malware chains: AMOS stealer on Mac, NetSupport Manager on Windows, see the Huntress SOC analyst breakdown. ## 35 Actionable Password Statistics for Businesses in 2026 | Huntress DevFeed: [35 Actionable Password Statistics for Businesses in 2026 | Huntress]() Original publisher: [Read original article]() Author: Brenda Buckman Published: 2026-09-10T13:00:00Z Content type: article Language: en Sources: [Huntress Blog]() Topics: [passwords](), [Cybersecurity](), [Security & Privacy]() Tags: [2026](), [business](), [credentials](), [cybersecurity](), [huntress](), [hygiene](), [password]() ### AI overview This article presents password-security statistics from several reports, covering weak and reused passwords, predictable patterns, stolen credentials, infostealers, and password-hygiene practices for protecting personal and business accounts. ### Source excerpt The top password statistics might surprise you. Learn how common poor password hygiene is, plus tips to better protect your precious credentials. ## Grand Theft Auto VI hype leads to malware DevFeed: [Grand Theft Auto VI hype leads to malware]() Original publisher: [Read original article]() Author: Matt Poto; Ben Nahorney Published: 2026-09-09T14:00:00Z Content type: article Language: en Sources: [Huntress Blog]() Topics: [Malware](), [Cybercrime](), [ransomware](), [Search engine optimization (SEO)](), [Disk image]() Tags: [browser](), [huntress](), [iso](), [malware](), [ransomware](), [seo]() ### AI overview Huntress analyzes malware distributed through fake GTA6 downloads promoted with SEO poisoning, gaming forums, torrent sites, and social media. The ISO sample contained a fake installer, remote access trojans, an infostealer, and wiper ransomware. ### Source excerpt Threat actors are exploiting GTA6 hype with fake leaked downloads spread via SEO poisoning, packed with RATs, infostealers, and wiper ransomware. Here's what Huntress found. ## Phishing Attacks Serve Browser-in-the-Browser Pages, Rogue RMM Persistence DevFeed: [Phishing Attacks Serve Browser-in-the-Browser Pages, Rogue RMM Persistence]() Original publisher: [Read original article]() Author: Sarah Reddish Published: 2026-09-09T13:00:00Z Content type: article Language: en Sources: [Huntress Blog]() Topics: [Security](), [Social engineering](), [browser](), [incident](), [Security Operations Center](), [Persistence](), [CSS](), [HTML](), [JavaScript]() Tags: [attacks](), [css](), [html](), [huntress](), [incident](), [indicators-of-compromise](), [javascript](), [phishing](), [security](), [security-operations-center](), [social-engineering]() ### AI overview The article examines two browser-in-the-browser phishing incidents in which attackers used fake browser windows and staged landing pages to persuade targets to download ScreenConnect installers. The resulting rogue remote-management instances and defense-evasion binaries enabled persistence on affected endpoints. ### Source excerpt See how a browser-in-the-browser phishing attack led to rogue ScreenConnect persistence and evasion tactics Huntress caught in the act. ## Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity DevFeed: [Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity]() Original publisher: [Read original article]() Author: John Hammond; Andrew Brandt; Lindsey O'Donnell-Welch Published: 2026-09-09T01:00:00Z Content type: article Language: en Sources: [Huntress Blog]() Topics: [Vulnerabilities](), [incident](), [Security](), [remote access](), [execution](), [file](), [Windows](), [Process]() Tags: [client](), [cve](), [cvss](), [huntress](), [incident](), [monitor](), [security](), [unrelated](), [vulnerability](), [windows](), [worm]() ### AI overview Huntress reports rogue ScreenConnect installations and unusual process execution across unrelated organizations. ConnectWise identified a file-transfer authorization flaw in affected ScreenConnect sessions and advised organizations to upgrade to version 26.6.5 or disable the relevant file-transfer permission while applying interim guidance. ### Source excerpt Huntress is tracking a pattern across multiple customer environments where rogue ScreenConnect clients repeatedly spawn the Windows Script Host to execute a series of four VBScript files. ## Inside Knight Office, a New M365 AiTM Phishing Kit DevFeed: [Inside Knight Office, a New M365 AiTM Phishing Kit]() Original publisher: [Read original article]() Author: Andrew Brandt; Andrea Hatcher; Lindsey O'Donnell-Welch Published: 2026-09-02T13:00:00Z Content type: article Language: en Sources: [Huntress Blog]() Topics: [Security](), [Cloaked Ursa](), [Entra ID](), [incident](), [Security Operations Center](), [Python](), [Flask](), [VirusTotal](), [Cloudflare](), [dashboards](), [telemetry]() Tags: [attacks](), [cloudflare](), [credentials](), [dashboard](), [entra-id](), [flask](), [huntress](), [microsoft](), [phishing](), [python](), [security-operations-center-soc](), [telemetry]() ### AI overview Huntress investigates Knight Office, an AiTM phishing kit used to steal Microsoft 365 session tokens. The report describes its phishing infrastructure, operator console, Entra ID persistence techniques, and Python Flask implementation. ### Source excerpt An inside look at Knight Office, a newly discovered AiTM phishing kit featuring custom control panels, Cloudflare Turnstile, and M365 Token theft. ## The Crypto Wallet That Never Opened: Tampered Exodus Installer Hides a Modular RAT DevFeed: [The Crypto Wallet That Never Opened: Tampered Exodus Installer Hides a Modular RAT]() Original publisher: [Read original article]() Author: Jonathan Semon; Jose Oregon Published: 2026-09-01T04:00:00Z Content type: article Language: en Sources: [Huntress Blog]() Topics: [Cryptocurrency](), [PowerShell](), [Windows](), [browser](), [App]() Tags: [2026](), [analysis](), [bitcoin](), [clickfix](), [credentials](), [crypto](), [ethereum](), [huntress](), [installer](), [malicious-javascript](), [manage](), [modular](), [msi](), [powershell](), [rat](), [scheduled](), [solana](), [wallet]() ### AI overview Huntress investigates tampered Exodus Wallet installers that conceal a modular remote access trojan. The malware uses decoy documents and a legitimate wallet installation to hide activity while stealing browser credentials across compromised Windows environments. ### Source excerpt Exodus crypto wallet analysis by Huntress uncovered tampered installers hiding a modular RAT focused on stealing credentials, not coins. ## Modern Phishing Tactics Include ClickFix, Browser Manipulation, and OAuth Consent Phishing DevFeed: [Modern Phishing Tactics Include ClickFix, Browser Manipulation, and OAuth Consent Phishing]() Original publisher: [Read original article]() Author: Shannon Grey; James O'Leary Published: 2026-08-28T16:00:00Z Content type: article Language: en Sources: [Huntress Blog]() Topics: [Security](), [Social engineering](), [ClickFix](), [Malware](), [Security Operations Center](), [Terminal](), [browser]() Tags: [authentication](), [clickfix](), [credential-harvesting](), [huntress](), [phishing](), [security](), [soc](), [social-engineering](), [terminal]() ### AI overview This article describes how modern phishing campaigns use browser manipulation, malicious cloud-app consent requests, social engineering, and ClickFix attacks to bypass traditional defenses. It also explains how Huntress SAT scenarios simulate these tactics to train users. ### Source excerpt Move past basic credential harvesting. Discover how modern attackers use ClickFix, BitB, and OAuth consent phishing--and how to train your users with Huntress SAT. ## New Huntress Managed ITDR Dashboard: Faster Identity Investigations DevFeed: [New Huntress Managed ITDR Dashboard: Faster Identity Investigations]() Original publisher: [Read original article]() Author: Erin Meyers Published: 2026-08-27T14:00:00Z Content type: release Language: en Sources: [Huntress Blog]() Topics: [dashboards](), [Security](), [Security Information and Event Management (SIEM)](), [Security Operations Center](), [self-service]() Tags: [dashboard](), [failed](), [huntress](), [identity](), [investigations](), [launch](), [security](), [siem](), [triage]() ### AI overview Huntress launched a redesigned Managed ITDR dashboard with Rapid Identity Triage, Failed Login Characterization, and Quick SIEM search to help customers investigate identity activity faster. ### Source excerpt Huntress' redesigned Managed ITDR dashboard adds Rapid Identity Triage, Failed Login Characterization, and Quick SIEM search for faster investigations. ## Huntress Investigation Examines Suspected DPRK Remote Workers DevFeed: [Huntress Investigation Examines Suspected DPRK Remote Workers]() Original publisher: [Read original article]() Author: Jai Minton; James Maclachlan Published: 2026-08-26T04:00:00Z Content type: article Language: en Sources: [Huntress Blog]() Topics: [Malware](), [account](), [GitHub]() Tags: [detection](), [dprk](), [github](), [huntress](), [identity](), [investigations](), [remote](), [threats]() ### AI overview Huntress analyzes incidents involving suspected North Korean remote workers who used deceptive identities to obtain jobs and funnel wages to the DPRK. The investigation describes indicators that may help organizations detect and prevent related threats. ### Source excerpt Huntress analyzed several incidents involving DPRK remote workers (Famous Chollima) in partner environments. Learn key indicators to detect and prevent North Korean threats. ## New View for Security Incident Investigations DevFeed: [New View for Security Incident Investigations]() Original publisher: [Read original article]() Author: Micah Neidhart Published: 2026-08-24T14:00:00Z Content type: release Language: en Sources: [Huntress Blog]() Topics: [incident](), [Security Operations Center](), [Security]() Tags: [dashboard](), [export](), [huntress](), [incident](), [investigations](), [pdf](), [reports](), [security](), [soc]() ### AI overview Huntress introduces a redesigned Investigations View and Dashboard that let partners review security investigations from the initial signal through final resolution. The view includes chronological timelines, analyst notes, incident reports, remediation steps, resolution status, search and filters, KPIs, and PDF export, including investigations closed as benign. ### Source excerpt See how the Huntress SOC runs security incident investigations from first signal to final resolution, including the ones closed as benign. ## RMM Abuse: How Attackers Exploit Remote Access Tools | Huntress DevFeed: [RMM Abuse: How Attackers Exploit Remote Access Tools | Huntress]() Original publisher: [Read original article]() Author: Beth Robinson Published: 2026-08-21T17:00:00Z Content type: article Language: en Sources: [Huntress Blog]() Topics: [remote access](), [Security](), [Social engineering](), [Security, Privacy and Abuse Prevention]() Tags: [huntress](), [malware](), [remote-access](), [security](), [social-engineering]() ### AI overview The article explains how attackers abuse legitimate remote monitoring and management tools to gain stealthy access, evade detection, and support social-engineering campaigns. It describes the risks of trusted remote access software and cites reported increases in this attack tactic. ### Source excerpt RMM abuse jumped 277% & now shows up nearly 40% of Huntress investigations. See how attackers exploit trusted remote access tools, and how to stop it. ## Huntress and the FBI Pursued Silk Typhoon After a Microsoft Exchange Attack Exposed 88,000 Backdoors DevFeed: [Huntress and the FBI Pursued Silk Typhoon After a Microsoft Exchange Attack Exposed 88,000 Backdoors]() Original publisher: [Read original article]() Author: Beth Robinson Published: 2026-08-10T13:00:00Z Content type: article Language: en Sources: [Huntress Blog]() Topics: [Cybercrime](), [Security](), [incident](), [Microsoft](), [Server]() Tags: [cybercrime](), [exploitation](), [fbi](), [huntress](), [incident](), [law-enforcement](), [microsoft-exchange](), [national-security](), [security](), [servers]() ### AI overview Huntress and the FBI investigated a Microsoft Exchange exploitation campaign attributed to Silk Typhoon after it created 88,000 backdoors. The article describes the public-private response, victim notification efforts, and the FBI's court-authorized removal of malicious web shells from vulnerable servers. ### Source excerpt Go inside Huntress and the FBI's five-year pursuit of Silk Typhoon, from 88,000 Exchange backdoors to an arrest and a wider fight against cybercrime. ## Huntress Tracks Device Code Phishing Activity Linked to BL Networks DevFeed: [Huntress Tracks Device Code Phishing Activity Linked to BL Networks]() Original publisher: [Read original article]() Author: Casey Smith Published: 2026-07-31T13:00:00Z Content type: news Language: en Sources: [Huntress Blog]() Topics: [Authentication](), [microsoft 365](), [Network](), [hosting](), [Linux](), [Windows]() Tags: [authentication](), [device-code-phishing](), [hosting](), [huntress](), [infrastructure](), [microsoft](), [microsoft-365](), [phishing](), [threat-intel]() ### AI overview Huntress reports an evolving wave of device code phishing targeting Microsoft 365 authentication, with activity linked to BL Networks and earlier activity associated with Railway and EvilTokens. ### Source excerpt Huntress is tracking an evolving wave of device code phishing that abuses trusted Microsoft 365 sign-in flows. Learn the signals defenders should watch for and how to respond. ## Huntress outlines an AI- and partnership-led strategy for expanding cybersecurity protection DevFeed: [Huntress outlines an AI- and partnership-led strategy for expanding cybersecurity protection]() Original publisher: [Read original article]() Author: Kyle Hanslovan Published: 2026-07-30T15:00:00Z Content type: opinion Language: en Sources: [Huntress Blog]() Topics: [Security](), [Artificial Intelligence](), [telemetry](), [API](), [Risk](), [Cloud]() Tags: [ai](), [api](), [cloud](), [community](), [cyberattacks](), [huntress](), [partnerships](), [revenue](), [security](), [strategy]() ### AI overview Huntress CEO Kyle Hanslovan describes the company's next phase after reaching $250 million in annual recurring revenue. He emphasizes AI with human oversight, API-powered coordination, global telemetry, research, and a broader partner network to respond faster to automated cyberattacks. ### Source excerpt CEO Kyle Hanslovan outlines how Huntress is evolving its research-led strategy, adopting AI with human oversight, and expanding its partner network to protect businesses against rapid, automated cyberattacks. ## $250M ARR Was Never the Goal. It Came From Staying True to Our Mission. DevFeed: [$250M ARR Was Never the Goal. It Came From Staying True to Our Mission.]() Original publisher: [Read original article]() Author: Kyle Hanslovan Published: 2026-07-30T14:00:00Z Content type: opinion Language: en Sources: [Huntress Blog]() Topics: [Cybersecurity](), [Business Security](), [Security & Privacy]() Tags: [business](), [ceo](), [cybersecurity](), [growth](), [huntress](), [mission](), [revenue](), [scale]() ### AI overview Huntress CEO Kyle Hanslovan reflects on the company's growth to $250 million in annual recurring revenue, arguing that the milestone followed its mission to provide cybersecurity protection and expertise to underserved small and mid-sized businesses. ### Source excerpt Hitting $250M ARR is a milestone, but it wasn't the goal. CEO Kyle Hanslovan reflects on Huntress' mission to protect the 99% and why staying true to it remains his top priority." ## Introducing Huntress Webhooks. Get Real-Time Security Alerts. DevFeed: [Introducing Huntress Webhooks. Get Real-Time Security Alerts.]() Original publisher: [Read original article]() Author: Micah Neidhart Published: 2026-07-29T14:00:00Z Content type: release Language: en Sources: [Huntress Blog]() Topics: [Security](), [observability](), [Security Information and Event Management (SIEM)](), [API](), [Automation](), [notifications](), [JSON](), [Slack](), [n8n]() Tags: [api](), [automation](), [huntress](), [json](), [latency](), [low-latency](), [security](), [siem](), [slack](), [webhooks]() ### AI overview Huntress Webhooks push incidents, escalations, platform actions, and account notices to customer-provided endpoints in real time. The release describes integrations with Slack, PSAs, automation platforms, and SIEM workflows, using structured JSON payloads without polling. ### Source excerpt Huntress Webhooks push incidents and escalations straight to Slack, your PSA, or SIEM in real time with no polling. See how you can set them up in minutes. ## Credential Stuffing Campaign Hits SonicWall | Huntress SOC Tracking DevFeed: [Credential Stuffing Campaign Hits SonicWall | Huntress SOC Tracking]() Original publisher: [Read original article]() Author: Jevon Ang; Ethan Williams Published: 2026-07-28T13:00:00Z Content type: article Language: en Sources: [Huntress Blog]() Topics: [incident](), [Virtual Private Network](), [Firewall](), [remote access](), [observability](), [Security Information and Event Management (SIEM)](), [Network](), [telemetry](), [Digital Ocean]() Tags: [2026](), [attacks](), [automated](), [credentials](), [devices](), [digitalocean](), [firewall](), [huntress](), [incident](), [infrastructure](), [ip](), [network](), [organizations](), [remote](), [remote-access](), [soc](), [telemetry](), [vpn]() ### AI overview Huntress reports an active, opportunistic credential-stuffing campaign targeting SonicWall VPN and firewall login portals. The campaign compromised dozens of organizations beginning July 25, 2026, using infrastructure associated with DigitalOcean. ### Source excerpt The Huntress SOC is tracking an active credential stuffing campaign targeting SonicWall devices, compromising dozens of organizations since July 25. ## CMMC Updates: DoW Pause and Huntress Hits 50% of Requirements DevFeed: [CMMC Updates: DoW Pause and Huntress Hits 50% of Requirements]() Original publisher: [Read original article]() Author: Jeremy Young Published: 2026-07-24T14:00:00Z Content type: opinion Language: en Sources: [Huntress Blog]() Topics: [audit](), [Protection](), [incident](), [Requirements]() Tags: [audit](), [cmmc](), [compliance](), [dow](), [huntress](), [incident](), [nist](), [protection]() ### AI overview The U.S. Department of War paused the November 2026 CMMC certification deadline, but existing CUI protection, NIST SP 800-171, DFARS, self-assessment, and prime-contractor obligations remain. The article explains the implications for suppliers and notes Huntress's reported coverage of 55 of 110 requirements. ### Source excerpt DoW paused the CMMC Phase II deadline in July, but the underlying compliance obligations didn't move. Meanwhile, Huntress Managed ISPM pushes our NIST SP 800-171 coverage to 55 of 110 requirements. Here's what changed, what didn't, and why we're not slowing down. ## Huntress Uses AI Agents to Triage SOC Signals Before Analyst Review DevFeed: [Huntress Uses AI Agents to Triage SOC Signals Before Analyst Review]() Original publisher: [Read original article]() Author: Spencer Engleson; Aimee Simpson Published: 2026-07-20T14:00:00Z Content type: article Language: en Sources: [Huntress Blog]() Topics: [Security Operations Center](), [AI Agent](), [Security](), [telemetry]() Tags: [ai-agent](), [huntress](), [soc](), [telemetry](), [triage]() ### AI overview Huntress describes Athena, an agentic investigation system of more than 40 specialized agents that automates SOC triage work before analysts review cases. The system groups related suspicious signals into investigations using shared characteristics such as processes, source IPs, and attack patterns. ### Source excerpt Learn how Huntress' AI signal triage and AI-powered SOC triage cut noise before it reaches human analysts. And discover why that matters for response times. ## Microsoft 365 Conditional Access Gaps Enabled Device Code Phishing and ROPC Attacks DevFeed: [Microsoft 365 Conditional Access Gaps Enabled Device Code Phishing and ROPC Attacks]() Original publisher: [Read original article]() Author: Aimee Simpson; Scott Riley; Rich Mozeleski Published: 2026-07-09T14:00:00Z Content type: article Language: en Sources: [Huntress Blog]() Topics: [microsoft 365](), [Security](), [Authentication](), [OAuth](), [MFA](), [Microsoft](), [Cloud]() Tags: [authentication](), [device-code-phishing](), [huntress](), [infrastructure](), [microsoft](), [microsoft-365](), [oauth](), [phishing](), [security]() ### AI overview Huntress describes two Microsoft 365 attack campaigns that bypassed or avoided MFA because Conditional Access policies did not explicitly block vulnerable authentication flows. The campaigns used device code phishing and the deprecated ROPC OAuth flow, with infrastructure including Railway IP addresses and an IPv6 range associated with LSHIY LLC. ### Source excerpt Two Microsoft 365 attacks got through Conditional Access policies that seemed fully configured. Learn what went wrong and how Huntress Managed ISPM catches these gaps first. ## Meta Phishers Abuse Business Account Manager Service | Huntress DevFeed: [Meta Phishers Abuse Business Account Manager Service | Huntress]() Original publisher: [Read original article]() Author: Andrew Brandt Published: 2026-07-07T12:00:00Z Content type: article Language: en Sources: [Huntress Blog]() Topics: [Meta](), [service](), [email](), [Chat Bot]() Tags: [account](), [credentials](), [email](), [huntress](), [messaging](), [meta](), [over](), [phishing](), [social-media](), [telegram]() ### AI overview Huntress investigates a phishing campaign that abused Meta's business partner service to send seemingly legitimate emails and steal Meta account credentials. The attackers used phishing pages, Telegram for credential delivery, and later added a chatbot component. ### Source excerpt Huntress is tracking a threat actor group as they evolve a phishing attack that uses a Facebook feature to send the initial spam lure. ## Celebrating Canada Day with Localized Managed Phishing DevFeed: [Celebrating Canada Day with Localized Managed Phishing]() Original publisher: [Read original article]() Author: James O'Leary Published: 2026-07-02T12:00:00Z Content type: release Language: en Sources: [Huntress Blog]() Topics: [Security](), [Risk](), [Users](), [ClickFix](), [Security Operations Center]() Tags: [canada](), [huntress](), [phishing](), [security](), [training]() ### AI overview Huntress Managed SAT is expanding its Managed Phishing service to Canada with English-language simulations based on familiar Canadian brands and scenarios. The company says localized lures are intended to improve engagement and help learners recognize phishing risk in a controlled environment. ### Source excerpt Huntress Managed SAT now offers localized phishing simulations for Canada, using familiar, country-specific brands and scenarios to provide more effective security awareness training for your learners. [Next page]()