Proactive Account Review Uncovers Unauthorized Surveillance Tools

Huntress identified a Defender exclusion for ActivTrak (BGStart.exe) applied across 13 hosts — notably including a medical clinic's hypervisor, domain controller, and an X‑ray machine — and raised concerns about potential data-privacy and defense-evasion risks from employee-monitoring software. The report explains how poorly scoped AV exclusions can blind defenses, cites previous large screenshot leaks from monitoring vendors, supplies ActivTrak endpoint and network IOCs for hunting, and recommends validating contracts, scoping deployments, reviewing admin access, and auditing for suspicious activity; no evidence of active compromise was observed.