Threat Actor surveilled via Huntress EDR

In a delightful twist of irony, threat actors accidentally installed Huntress EDR on their own operational machine after finding it through a Google ad. Huntress got a front-row seat to watch them use AI tools for efficiency, automate workflows with Make.com, and shop for Evilginx and residential proxies, ultimately leading to the discovery of over 2,400 compromised identities. In updates to the post on 9 and 11 September, Huntress defended the monitoring as its SOC responding to malware alerts on the host, and corrected its own story: the attacker did not remove the agent, its analysts forcibly uninstalled it 84 minutes after installation. Pro tip: maybe don’t click on ads when you’re the bad guy.