Elastic’s Threat Report Reveals Attackers Are Turning Trusted AI and IT Tools Against the Enterprises That Deploy Them

Attackers are putting legitimate software to illegitimate use: executing commands through AI agents, abusing trusted IT tools, and using stolen credentials in minutes

SAN FRANCISCO--(BUSINESS WIRE)--Elastic (NYSE: ESTC) today announced threats, etc, the latest report by Elastic Security Threat Command. The report reveals evidence of attackers abusing the trust and deep system-level access enterprises give to AI tools and agents. Elastic Security Threat Command found that attackers are logging in with stolen credentials an average of eight minutes after infection, using AI applications to execute commands, and abusing legitimately signed remote monitoring tools. The report draws on confirmed live intrusions and first-party research between April and September 2026 and publishes the artifacts and detection logic defenders need to hunt for the same activity.

Security teams have long built their controls on trust in approved software. Defenders now face a choice: alert on every action an AI tool takes and drown in noise, or trust their AI and IT tools by default and risk missing real attacks.

“Attackers hiding inside trusted software isn’t new. Defenders have been fighting living-off-the-land techniques for decades, and MITRE ATT&CK has an entire tactic built around it,” said Mike Nichols, general manager, Security, Elastic.

“What’s new is that enterprises are increasingly deploying powerful trusted tools that most security teams struggle to fully monitor, control, or even explain: AI agents. An agent that holds credentials and can reach the internet is a new attack surface, whether it’s misconfigured or abused. When an attacker is behind it, its activity looks exactly like the employee who installed it. So the question for defenders isn’t whether a tool is approved; it’s what that tool is actually doing.”

What the research revealed

Attackers are running commands through AI tools

• Elastic researchers observed live intrusions in which attackers executed commands through Claude Code on Windows and ChatGPT desktop on macOS.
• In one live intrusion on macOS, a single command read an internal infrastructure document and then pulled saved passwords from the user’s keychain.
• An attacker connected remotely to a Windows machine, used Claude Code to stage tools, and reached an outside server through a concealed connection.

Attackers only need seconds to cause damage

• Across 27 confirmed cases involving password-stealing malware, Elastic researchers observed how quickly attackers used stolen credentials, averaging just eight minutes between infection and login.
• The most common way in was a ClickFix lure, a fake prompt that tricks users into pasting and running a malicious command themselves. It was the starting point in 12 of the 27 cases (44%). The theft then kept running inside software the device already trusted, such as browser updaters and Apple’s built-in scripting tools.
• In one healthcare case, attackers delivered malware about 16 seconds after the user fell for a malicious lure.

AI agents operate at speed, around the clock

• AI agents can execute thousands of actions with limited human intervention, continuing to work through errors and failed attempts, as seen in the July 2026 Hugging Face breach. Elastic researchers conducted a forensic reconstruction of the breach and found that signs of an AI agent at work included duplicate commands seconds apart and a working exploit followed immediately by a basic coding error.
• Sustained activity of this kind highlights the challenge defenders face in distinguishing legitimate agent behavior from malicious activity at scale.

Attackers continue to abuse legitimate IT tools

• Elastic confirmed 23 cases in which attackers installed legitimate remote IT software to keep hands-on access to a device, most often ScreenConnect.

What defenders should know

Elastic Security Threat Command recommends that defenders inventory the AI tools, IT tools, and signed software they trust, and treat anything outside that list as suspect. Defenders should evaluate trusted software based on its behavior, such as what an AI tool launches or where a remote IT tool connects, not by whether it is approved. They should also baseline normal activity across systems so abuse stands out, and correlate signals across cloud, endpoint, and identity data. Elastic Security monitors low-level system activity and is designed to detect behaviors like proxy tunneling and memory tampering, regardless of which application starts them. The full threats, etc report provides detailed recommendations for identifying suspicious activity involving trusted AI and IT tools and compromised credentials.

About the Report

threats, etc is a quarterly report series from Elastic Security Threat Command that replaces Elastic’s annual Global Threat Report. It is published quarterly because attacker tradecraft, including the abuse of AI agents, is changing faster than an annual cycle can track. Each edition focuses on notable techniques rather than raw telemetry counts, and the figures reflect confirmed findings, not global prevalence.

Additional Materials

Report: threats, etc by Elastic Security Threat Command
Blog: When trust becomes the payload: Inside the threats, etc quarterly report

About Elastic

Elastic (NYSE: ESTC) integrates its deep expertise in search technology with artificial intelligence to help everyone transform all of their data into answers, actions, and outcomes. Elasticsearch, which is the foundation for its search, observability, and security solutions, is used by thousands of companies, including more than 75% of the Fortune 100. Learn more at elastic.co.

Elastic and associated marks are trademarks or registered trademarks of elasticsearch B.V. and its subsidiaries. All other company and product names may be trademarks of their respective owners.