The attacker, a 20-year-old dual Austrian-North Macedonian citizen born in Modling, arrived at Schwedenplatz at 7:31 PM. He initially walked toward the Le Salzgries restaurant, circling it twice before finding it closed. Changing course to Seitenstettengasse, he prepared near a hotel building and opened fire. He ran east, then north through a pocket park, reloading as he moved. At 8:03 PM, two police officers in a patrol car confronted him. He shot one officer in the thigh. The attacker fled down Franz-Josefs-Kai toward St. Rupert's Church, pausing to fire at a rental car and drawing thrown objects from a bystander who tried to impede him. At 8:08 PM, police shot him from 50 meters distance in the churchyard. The entire attack lasted roughly nine minutes. He wore a fake explosive belt under his jacket, a detail that initially complicated the police response.

Four people died that evening: a 39-year-old Austrian man, a 24-year-old German woman, a 44-year-old Austrian woman, and a 21-year-old Austrian man originally from North Macedonia. Twenty-three others were wounded by gunshots and stab wounds, including 13 Austrian citizens, four Germans, two Slovaks, and one each from Afghanistan, Bosnia and Herzegovina, China, and Luxembourg. Among the wounded was a 28-year-old police officer, critically injured while responding. In the chaos, acts of extraordinary courage emerged. A Palestinian man and two Turkish-Austrian men carried the wounded officer and an elderly woman away from the attacker to waiting ambulances. One of the Turkish-Austrians was himself shot and wounded while confronting the gunman. Their actions were widely recognized in the days that followed as moments of shared humanity amid violence.

The investigation revealed a chain of warnings that went unheeded. The attacker had been sentenced to 22 months in prison in April 2019 after attempting to cross the Turkish border into Syria to join ISIL. He was paroled after just eight months, in December 2019. Austrian intelligence services knew he had attended a mosque suspected of promoting extremism. Slovak police in Bratislava had reportedly blocked his attempt to purchase ammunition and notified Austrian authorities. Hours before the attack, he pledged allegiance to ISIL in Arabic on Instagram, using the name Abu Dujana al-Albani. ISIL later claimed responsibility, though investigators were uncertain whether the group had helped plan the attack or simply adopted it after the fact. The attacker's early release from prison, despite his documented radicalization, became a central point of public scrutiny and political debate.

The immediate response was massive. EKO Cobra special forces and WEGA tactical units flooded central Vienna. The Austrian Federal Army secured government buildings. Trams and subways were halted. Roadblocks went up around the city center, and police urged residents to shelter in place. Enhanced checks were instituted at the Czech border. The following day, all synagogues, Jewish schools, and kosher establishments in Vienna were closed as a precaution, after initial fears - later disproven - that the main synagogue had been the target. On November 6, authorities closed two mosques in the Ottakring and Meidling districts, citing their role in the attacker's radicalization. On November 11, the Islamic cemetery in Wien-Liesing refused to allow the attacker to be buried there. A memorial now stands at Friedmann-Platz, quiet and small, the kind of marker that forces you to pause in a city that learned it was not exempt from the violence of its era.