When a Hacker Accidentally Installs Your EDR

A threat actor accidentally installed Huntress's own managed EDR while hunting for security tools, giving the company a rare front-row view of attacker operations — and sparking a viral debate Jamie Levy walks through here 1:00.

Key Takeaways:
• The attacker found Huntress via a Google search and deliberately installed a free EDR trial — it wasn't an accident 6:56
• In a few hours, the SOC triaged malware alerts, pulled Chrome history, and found the "customer" was an attacker exploiting other Huntress customers, then forcibly uninstalled the agent 2:18
• Found on the machine: stolen credentials, hijacked cookies, bank-employee reconnaissance, cracked tools, AI Telegram bots, and evidence of 2,000+ compromised identities 3:31
• Microsoft later published a blog on the same attacker (matching hostname IOCs), verifying Huntress's assessment of a West Coast VM 8:26
• The story went viral; critics alleged "spying," but after respectful explanation even skeptics like VX Underground came around 9:43
• Lessons: educate without assuming shared knowledge, stay respectful, and stand firm 15:31

Levy closes by emphasizing Huntress will keep publishing threat research, calling the incident a valuable learning experience.

Sources:

• 1:00 How the attacker found Huntress
• 2:18 Investigation timeline
• 3:31 Artifacts found on the attacker's machine
• 8:26 Microsoft's corroborating blog
• 9:43 The viral debate and reconciliation
• 15:31 Lessons learned