Are half-click attacks a concern for IT teams?

Sponsored by

Your AI strategy has a security problem: 43% of IT leaders now cite security concerns as the top barrier to expanding AI agent deployment, according to research from JumpCloud. Before giving agents more access to apps, data, and workflows, make sure you can govern the identities behind them. See how to secure every identity, human or not.

You’ve likely heard of zero-click attacks, in which an attacker sends malware via vulnerable applications such as messaging or email, infecting a system without the victim actually having to click or download anything.

Half-click attacks, in which simply previewing or opening an email is enough to trigger malicious code, are an insidious variation on zero-click attacks. They have also gained momentum over the past year; for example, cybersecurity experts recently warned that threat actors have begun using this exploit against Outlook Web Access.

According to Tim Rawlins, director and senior advisor for global cybersecurity company NCC group, half-click attacks are expected to become more of an issue for the private sector because of “this ability to create valid exploits.”

“Zero click needs no action, maybe half-click needs just opening or previewing a message,” Rawlins said. “The pressure has actually come back onto the technology side, and the IT team, the security team…they now have to up their game in order to be able to deal with this.”

Starting with half. Greg Lesnewich, principal threat research engineer at Proofpoint, said that, while half-click attacks bear some similarities to zero-click attacks, the former belongs in its own category.

“At least in the email space, we’ve never interacted with anything that had this amount of subtlety,” Lesnewich said. “This is not an incredibly technically sophisticated exploit, even though it…feels very early ’90s or late ’90s hackery, where there’s a subtleness and quickness that comes with it.”

Half-click attacks are a problem the IT department needs to solve by patching vulnerabilities as quickly as possible. In the past, security professionals may have waited to apply patches to protect business operations from downtime, but Rawlins suggested it’s more important than ever to apply fixes quickly and look for evidence of intrusion.

“The tempo has got to increase,” Rawlins said. “Unfortunately, we haven’t got that luxury of time anymore.”

Rawlins stressed that professionals not only have to boost the rate at which they patch vulnerabilities, but also inspect an email system’s permissions to ensure attackers aren’t accessing mailboxes and exfiltrating data.

“Patch first, but don’t stop at patching, look for evidence that the attack arrived before the fix has been put in place,” Rawlins said. “You’ve got to dig all the way through that, and it’s always going to be legacy, unsupported, unpatched systems that are vulnerable.”