A cyber attacker installed the Huntress endpoint security solution to protect himself. What he didn’t realize was that this allowed Huntress to monitor his activities. Despite some controversy, the security company claims that valuable information was obtained.
When a host signaled malware to Huntress, it turned out to be an old acquaintance: the same “machine name,” or unique device identifier, had appeared in several previous incidents. When Huntress analysts looked at the host in more detail, they saw evidence of research into potential targets via the browser history.
Huntress removed its own agent after 84 minutes, but with all the information obtained, it was clear that the malicious user had taught himself AI tooling for spreading malware, was researching cryptocurrency, and was using automation solutions. The host’s profile could be mapped from May to July 2025.
Dissatisfied colleagues
Huntress’ explanation is in-depth. As the security company states, it is fascinating to see exactly how an attacker works. It was already clear that cybercriminals use AI, but this example shows that the way they do so is diverse and innovative. Also striking but entirely logical: cyber attackers want to be equipped with security software just as much as their victims.
However, Huntress’s example caused controversy. It was not initially clear that Huntress had uninstalled its own agent (installed via a trial membership) and therefore had not provided the cybercriminal with security. Fellow security specialists are also concerned about the extent to which anyone, malicious or not, can be monitored in detail by security services.
Others argue that the alleged invasion of privacy by the attacker is justified, primarily because the software was installed voluntarily and because the attacker was proven to be malicious. Huntress’s surveillance only took place because there were signs of malware, a legitimate reason to take a look at a customer’s system.
In any case, the Huntress blog presents a striking story that, whether justified or not, offers insight into the thinking and behavior of a cyber attacker.
Read also: Ransomware gang takes legal action against victim