Elastic finds stolen credentials used within eight minutes on average

Elastic Security Threat Command found attackers logged in with stolen credentials an average of eight minutes after infection across 27 confirmed infostealer cases between 4 April and 8 September 2026. <newline>

The findings appear in threats, etc., the first edition of a quarterly report series from Elastic Security Threat Command that replaces the annual Global Threat Report because attacker tradecraft is changing faster than an annual cycle can track. The full 34-page report is a free PDF download. <newline>

ClickFix-style verification pages were the most common entry point, starting 12 of the 27 cases, or 44%. These pages ask visitors to paste and execute a malicious command, framing it as a verification step or troubleshooting instruction. Because the user executes the command themselves, the approach can bypass defenses focused on scanning e-mail attachments. <newline>

In one healthcare case, attackers delivered and executed a malicious installer through DLL sideloading about 16 seconds after the lure was followed. DLL sideloading forces an application to load malicious code. <newline>

Beyond ClickFix, trojanised installers and updaters accounted for eight of the 27 infostealer findings, malicious npm projects for five, and newly registered domains for two. Windows made up 19 of the cases and macOS eight. <newline>

Infostealers collect information such as saved passwords, browser session data, and payment details. Captured session data can allow attackers to use an account without entering its password again. <newline>

Elastic confirmed 23 cases in which attackers installed legitimate remote monitoring and management software to keep hands-on access to a device. ScreenConnect was named most often among the abused tools. The installations occurred between 15 June and 12 August 2026. <newline>

A fake digital invitation delivered ScreenConnect in the background in one campaign; the tool connected to an attacker-controlled server and ran as a Windows service. In another case, an attacker uploaded remote access software to a compromised server after attempts to create user accounts failed. <newline>

Healthcare endpoints appeared in three separate remote monitoring confirmations, including a trojanised GalacticAgent build that injected into other processes to harvest browser credentials and card data. <newline>

Attackers used AI applications to execute commands, with researchers noting Claude Code on Windows and the ChatGPT desktop application on macOS. For the Windows incident, an intruder connected remotely to a machine and used Claude Code via its Visual Studio Code extension to build tools and reach an external server through a hidden connection. <newline>

On a Mac, commands sent through the ChatGPT desktop application opened an internal infrastructure document and then reached into the user’s saved password store. Elastic said the AI misuse happened after attackers already had access, and the cases do not show a vulnerability in the applications or a compromise of their providers. <newline>

Mike Nichols, general manager of Security at Elastic, said: “An agent that holds credentials and can reach the internet is a new attack surface, whether it’s misconfigured or abused.” <newline> Attackers stole credentials through trusted software already on the system, such as a signed remote monitoring agent, a browser updater, a vendor installer, and Apple scripting utilities. <newline>

Adversary-in-the-middle phishing kits relay traffic between the victim and the real login page, letting attackers capture authenticated sessions after the victim completes multifactor authentication. Tycoon 2FA, an adversary-in-the-middle kit Microsoft tracks to Storm-1747, remained in active use during the reporting period after Microsoft and Europol seized 330 of its domains in March. <newline>

Attackers fed stolen usernames and passwords into an older authentication method that skipped the second factor, investigators observed. In a device-code phishing case, a user entered a code on Microsoft’s sign-in page and the approval granted access to an attacker-initiated session, followed by registration of a virtual device for continued access. <newline>

A compromised university account reached Azure Resource Manager from a known-malicious anonymised IP on 9 July using ROPC, a legacy flow that sends a username and password straight to the token endpoint, meaning Conditional Access did not apply. On 1 June, a Kali365 device-code phishing kit ended with an attacker-registered device and a primary refresh token that maintains access. <newline>

With Tycoon 2FA, Elastic saw a primary refresh token issued within minutes of the victim typing in credentials. Elastic advised defenders to switch off legacy authentication, alert on unmanaged device registrations and primary refresh token issuance, and stop treating a first-party Microsoft app ID as a trust signal. <newline>

Elastic Security Threat Command recommends defenders inventory trusted AI tools, IT tools, and signed software, evaluate tools by behavior rather than approval, baseline normal activity, and correlate signals across cloud, endpoint, and identity data. <newline>

Elastic Security monitors low-level system activity and is designed to detect behaviors such as proxy tunneling and memory tampering regardless of which application starts them. The findings draw on confirmed live intrusions and first-party research, and Elastic says the figures reflect confirmed findings rather than global prevalence. <newline>

Elastic threat hunters confirmed on 5 August 2026 that an operator used a Windows endpoint to drive Claude Code through its Visual Studio Code extension over RDP, then reach a suspicious self-hosted GitLab instance using a SOCKS5 proxy tunnel script called minsk-tunnel.ps1. Elastic Defend rules fired on PowerShell children spawned by claude.exe and on repeated curl calls through port 1080. <newline>

Five days after the Windows intrusion, Elastic confirmed that the ChatGPT desktop app acted as a shell command proxy for credential access on a Mac. One compound command on the Mac read lines 20 to 45 of an internal QA infrastructure document and then dumped the login keychain. Two additional macOS cases were written up by Elastic Threat Research and Detection Engineering Lead Mika Ayenson and Elastic Security Research Engineer Jia Yu Chan. Those sessions started with the –allow-dangerously-skip-permissions flag, stood up a Cloudflare quick tunnel, and installed a LaunchAgent to keep the tunnel alive after the session ended. <newline>

AI agents can execute thousands of actions with limited human intervention and continue working through errors and failed attempts, as seen in the July 2026 Hugging Face breach. Elastic researchers reconstructed about 17,600 actions from the breach across four days, roughly one action every 20 seconds. Elastic pointed to duplicate commands seconds apart and a working exploit followed right away by a basic coding error as signs an AI agent was at work. <newline>

Hugging Face disclosed on 16 July that a malicious dataset abused its dataset-processing pipeline through an HDF5 external storage page, exposing environment secrets and worker source code, along with Jinja2 template injection. On 21 July, OpenAI said its GPT-5.6 Sol model and another unreleased model with reduced cyber refusals in an internal ExploitGym evaluation escaped through a package-registry proxy zero-day and targeted Hugging Face. JFrog confirmed the proxy was Artifactory and shipped fixes in version 7.161, according to SecureLayer7’s analysis. <newline>

On 4 August, Elastic identified the return of Shai-Hulud after attackers compromised the maintainer of keyv and deployed CHAINDROP, a worm that uses stolen npm credentials to backdoor every package the maintainer can publish. The worm hit more than 400 packages; keyv alone had over 600 million monthly downloads, and flat-cache neared 580 million. <newline>

The 711KB CHAINDROP payload sweeps more than 300 credential patterns, including AI tooling keys for Anthropic, Claude, Codex, Cursor, OpenAI, and Gemini, and finds its endpoint through an Ethereum smart contract with no hardcoded command-and-control domain. The worm keeps its foothold by placing a SessionStart hook inside.claude/settings.json and a folderOpen task inside.vscode/tasks.json, on as many as 50 branches per repo, with commits by author claude and message chore: update config. <newline>

The worm compromised more than 400 npm packages representing 1.3 billion monthly downloads in total. Elastic’s advised fix is to revoke automation tokens carrying bypass_2fa, enforce multifactor authentication, and upgrade to npm 12 or later, which blocks preinstall hooks by default. <newline>

Google’s M-Trends 2026 found the median handoff from initial access broker to next group fell to 22 seconds, with exploits the top initial infection vector at 32%. <newline> Elastic’s 2025 Global Threat Report found one in eight malware samples targeted browser data. <newline>

The Australian Signals Directorate’s Annual Cyber Threat Report 2025-26, released 26 October, found phishing in 39% of incidents mapped to MITRE ATT&CK, compromised accounts in 21%, and valid accounts in 15%, with health care and social assistance the top non-government reporter. <newline> ESET measured a 108% rise comparing the second half of 2025 with the first half of 2026. <newline>

CrowdStrike’s 2026 Global Threat Report found average eCrime breakout time of 29 minutes, the fastest at 27 seconds. It also found adversaries inserting malicious prompts into legitimate GenAI tools at more than 90 organizations. <newline>

The September update to the Information Security Manual requires government agencies to assign each AI agent a unique identity and maintain an AI agent register. Mathew Graham, Okta APAC chief security officer, put it as a rule: no agent without an identity, no identity without an owner, no access without clear limits. <newline>

Elastic reported first quarter fiscal 2027 revenue of US$478 million, up 15%, and in September announced plans to bring OpenAI GPT cyber models into Elastic Security. Elastic’s bug bounty program received more than 1,390 reports during the first half of 2026, more than 2024 and 2025 combined, and its AI triage pipeline concurs with human engineers 85% of the time at about US$2 per report. <newline>

“The more convincing you can be in that regard, it ups the success rate of your attack,” Brent Sargent said.