Tradecraft Tuesday Recap | Huntress

What it is

A Tradecraft Tuesday session (Huntress CISO Chris Henderson, Director of Security and IT Brian Milbier) that pairs threat awareness with concrete, teachable defensive guidance. The summary names the three threats — CVE-2025-55182 "React2Shell," ClickFix, and living-off-trusted-sites (LoTS) phishing — but not the operational advice, which is why this is worth a note.

Preconditions / Affected

For React2Shell (CVE-2025-55182): React is described as ubiquitous and typically internet-facing by default, so exposure is broad. Milbier notes the barrier to entry collapses once GitHub proof-of-concepts spread — the exploit becomes copy-paste.

What to do

React2Shell / CVE-2025-55182. Henderson frames this as a speed problem, not just a patch problem: GreyNoise data showed exploitation climbing from near zero to hundreds of attacks per hour within days, which he compares to Log4Shell scale. His stated guidance:

• Assess exposure now — "Where are we vulnerable? Can we patch this? Are there compensating controls?"
• Plan toward a 24-hour turnaround at a bare minimum for discovering and acting on new vulnerabilities.

ClickFix. The page gives three plain rules to hand to non-technical users:

• If a "human verification" step asks you to leave the browser and run something on your computer, it's malicious.
• If anything asks you to paste from your clipboard to "verify," assume it's a trap.
• There is no legitimate anti-bot flow that requires executing random commands on your machine.

Detection caveat worth flagging to defenders: because the victim runs the tools themselves, system logs show the user intentionally launching processes and executing commands — so it evades many behavioral detections and looks legitimate on review. Henderson predicts most people will encounter some variant within six months.

LoTS phishing. The defensive point is what stops working: filters that rely on sender novelty ("Chris never emailed you before"), domain reputation, and common spam heuristics all break when the sender is genuinely PayPal, DocuSign, Intuit, or OneDrive/Google Drive. Henderson's own example was a valid-looking PayPal email linking to a fake Samsung subscription page designed to trigger panic over a recurring charge; it even carried partial-authentication "soft fail" (SPF) signals that ordinary users never notice. AI has removed the old tells (bad grammar, lookalike domains), so the lure now targets urgency, fear, shame, and authority rather than pattern-matchable artifacts.

Caveats

The page's LoTS section on what actually replaces reputation-based filtering is cut off mid-sentence ("So what replaces the ol…"), so any concrete replacement control is not captured here. Exploitation figures are Huntress/GreyNoise observations, not independently reproduced in the text.