Defense Drill Interventions
This is something our Security Operations Center (SOC) has seen happen over and over again since we launched the Attack Disruption Engine in April 2026.
This is something our Security Operations Center (SOC) has seen happen over and over again since we launched the Attack Disruption Engine in April 2026.
You just had a user fall for a ClickFix attack, but thankfully, Attack Disruption from Managed EDR shut it down before the attacker could launch an infostealer.
Join us on November 17 for the livestream "Training at SOC Speed: How New Threats Lead to New Defense Drills," as we'll give you the first look at Defense Drills and Attack Disruption in action.
Defense Drills are a new type of training content that's short, hands-on, and built on prominent or emerging tradecraft that the Huntress SOC is actively observing.
But there's just one problem…a few minutes later, the same user falls for the exact same ClickFix attack again.
With Defense Drill Interventions, ClickFix attacks are shut down by Managed EDR Attack Disruption, and in that same moment, the user will see a pop-up with a Defense Drill covering ClickFix attacks.
That's thousands of people falling for a real-world ClickFix attack without any lessons learned.
It's shutting down threats while reducing future human risk Figure 5: When Attack Disruption shuts down a ClickFix attack, the user sees a just-in-time Defense Drill.
In 2025, ClickFix was responsible for more than half of all malware loader activity .
Now, you'd think this means the threat has been mitigated and you can move on; in fact, of the over 25,000 hosts we've seen with a ClickFix signal, 29% made more than one attempt.
What happened
This is something our Security Operations Center (SOC) has seen happen over and over again since we launched the Attack Disruption Engine in April 2026.
You just had a user fall for a ClickFix attack, but thankfully, Attack Disruption from Managed EDR shut it down before the attacker could launch an infostealer.
What changed
Join us on November 17 for the livestream "Training at SOC Speed: How New Threats Lead to New Defense Drills," as we'll give you the first look at Defense Drills and Attack Disruption in action.
Defense Drills are a new type of training content that's short, hands-on, and built on prominent or emerging tradecraft that the Huntress SOC is actively observing.
Who is affected
But there's just one problem…a few minutes later, the same user falls for the exact same ClickFix attack again.
With Defense Drill Interventions, ClickFix attacks are shut down by Managed EDR Attack Disruption, and in that same moment, the user will see a pop-up with a Defense Drill covering ClickFix attacks.
Why it matters
That's thousands of people falling for a real-world ClickFix attack without any lessons learned.
It's shutting down threats while reducing future human risk Figure 5: When Attack Disruption shuts down a ClickFix attack, the user sees a just-in-time Defense Drill.
Technical details
In 2025, ClickFix was responsible for more than half of all malware loader activity .
Response
Now, you'd think this means the threat has been mitigated and you can move on; in fact, of the over 25,000 hosts we've seen with a ClickFix signal, 29% made more than one attempt.
Attribution
Huntress: You just had a user fall for a ClickFix attack, but thankfully, Attack Disruption from Managed EDR shut it down before the attacker could launch an infostealer.
What to watch next
Watch for new exploitation reports and updated indicators of compromise.
Watch for updated vendor guidance and fixed-version details.