Elastic report: attackers log in 8 minutes after infostealer infection, abusing signed RMM tools (ScreenConnect), AI assistants and AiTM phishing
Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 09/11/2026 12:15; os links antigos trazem para cá.
Fontes: helpnetsecurity.com ↗ elastic.co ↗
Elastic Security Threat Command's quarterly threats, etc report, covering April-September 2026 and based on confirmed customer intrusions, describes a shift from custom malware to abuse of trusted, signed software and legitimate workflows (elastic.co). Attackers used stolen credentials to authenticate an average of eight minutes after infection across 27 confirmed infostealer cases (helpnetsecurity.com). Researchers also documented 23 cases of remote monitoring and management (RMM) abuse, with ScreenConnect named most often (elastic.co, helpnetsecurity.com). The report also covers intrusions where attackers ran commands through AI coding assistants, Claude Code on Windows and the ChatGPT desktop application on macOS. Elastic states these were post-compromise misuse and do not indicate a vulnerability in, or compromise of, those applications (helpnetsecurity.com). ClickFix-style verification pages were the most common entry point, seen in 12 cases (helpnetsecurity.com). Elastic's authors conclude that signature-based detection is insufficient against activity inside trusted software (elastic.co, helpnetsecurity.com).
Detalhes técnicos
- Infostealers: they collect saved passwords, browser session data and payment details. Captured session cookies let attackers reuse accounts without a password (session hijacking). Theft ran through already-trusted software: a signed remote monitoring agent, a browser updater, a vendor installer and Apple's scripting utilities (helpnetsecurity.com).
- Speed: in one healthcare case, a paste-and-run (ClickFix) lure led to MSI delivery and DLL sideloading in roughly 16 seconds (elastic.co, helpnetsecurity.com).
- AI agent abuse: one case produced about 17,600 reconstructed actions over four days (elastic.co). On Windows, an attacker with remote access used Claude Code through its Visual Studio Code extension to stage tooling and reach an external server over a concealed connection. On macOS, commands run through the ChatGPT desktop application read an internal infrastructure document and then accessed the user's saved password store (helpnetsecurity.com).
- RMM abuse: phishing pages and archives with malicious scripts led to installs. One campaign used a fake digital invitation to silently install ScreenConnect, which beaconed to an attacker-controlled server and ran as a Windows service. In another case an attacker uploaded remote access software to a compromised server after failing to create user accounts (helpnetsecurity.com).
- Identity attacks: AiTM phishing kits, including Tycoon 2FA (still in active use during the period), relayed victims to the real login page and captured the authenticated session after MFA. Attackers also replayed stolen credentials through a legacy authentication method that allowed access without a second factor. A separate device-code phishing case tricked a user into entering a code on Microsoft's sign-in page, and follow-on activity included registering a virtual device for persistence (helpnetsecurity.com).
- Attackers increasingly rely on legitimate, signed first-party tools (RMM agents, AI coding assistants, Microsoft first-party clients) rather than custom malware (elastic.co).
Remediação
Elastic recommends UEBA to baseline normal activity, cross-domain visibility and correlation, and detection based on system-level behavioral outcomes (e.g., memory tampering, proxy tunneling) rather than signatures (elastic.co). It also suggests automated triage pipelines combining telemetry, deterministic rules and AI reasoning (e.g., Elastic Workflows) to manage alert volume and keep pace with machine-speed attacks (elastic.co). The later source's remediation text is truncated in the input, so further recommendations are not captured here.
Linha do tempo
-
Elastic reports attackers logging in 8 minutes after infostealer infection, abusing AI coding assistants and signed RMM tools
ler a análise desta fonte ocultar
A report from Elastic Security Threat Command finds that attackers used stolen credentials to authenticate an average of eight minutes after infection across 27 confirmed infostealer cases on customer endpoints. Theft was carried out through already-trusted software — a signed remote monitoring agent, a browser updater, a vendor installer and Apple's scripting utilities — rather than through unsigned binaries. ClickFix-style verification pages were the most common entry point, seen in 12 cases, persuading users to paste and run a malicious command themselves and so bypassing attachment-scanning defences. Researchers additionally documented 23 cases of abuse of remote monitoring and management (RMM) software, with ScreenConnect named most often, and intrusions in which attackers ran commands through AI coding assistants (Claude Code on Windows, the ChatGPT desktop application on macOS). Elastic states these AI cases were post-compromise misuse and do not indicate a vulnerability in, or compromise of, those applications.
Technical Details
- Infostealers: collect saved passwords, browser session data and payment details; captured session cookies let attackers reuse accounts without re-entering a password (session hijacking).
- Speed: in one healthcare case, a malicious installer was delivered and executed via DLL sideloading roughly 16 seconds after the user followed the ClickFix lure.
- AI application abuse: on Windows, an attacker with remote access used Claude Code through its Visual Studio Code extension to stage tooling and reach an external server over a concealed connection; on macOS, commands run through the ChatGPT desktop application read an internal infrastructure document and then accessed the user's saved password store.
- RMM abuse: phishing pages and archives containing malicious scripts led to installs; one campaign used a fake digital invitation to silently install ScreenConnect, which beaconed to an attacker-controlled server and ran as a Windows service. In another case an attacker uploaded remote access software to a compromised server after failing to create user accounts.
- Identity attacks: AiTM phishing kits, including Tycoon 2FA (still in active use during the reporting period), relayed victims to the real login page and captured the authenticated session after MFA. Attackers also replayed stolen credentials through a legacy authentication method that permitted access without a second factor. A separate device-code phishing case tricked a user into entering a code on Microsoft's sign-in page, granting the attacker a session; follow-on activity included registering a virtual device for persistence.
Remediation
Elastic's authors argue signatures alone are insufficient when activity occurs inside trusted software or on behalf of trusted users, and recommend UEBA baselining of normal activity plus cross-domain visibility and active correlation. Practical controls implied by the findings: inventory and allow-list RMM agents, disable legacy/basic authentication and device-code flows where not required, bind sessions and shorten token lifetimes to blunt cookie theft, and monitor what AI coding assistants with credential and shell access actually execute.
-
Elastic Report: Attackers Abuse RMM Tools, AI Assistants and Identity Trust for Fast, Malware-Free Intrusions
ler a análise desta fonte ocultar
Elastic Security Threat Command's quarterly threats, etc report (April-September 2026) describes a shift away from traditional malware toward abuse of legitimate, trusted software and workflows to gain and maintain access. Based on confirmed customer intrusions, the report highlights three trends: abuse of signed RMM tools (with ScreenConnect named most often, 23 confirmed findings), AI coding assistant/agent-driven attacks generating tens of thousands of actions in days, and identity-based compromise via AiTM phishing and legacy authentication gaps that can turn an infostealer infection into tenant login within minutes. A healthcare intrusion is cited where a paste-and-run lure led to MSI delivery with DLL sideloading in roughly 16 seconds, and a separate case saw an AI agent produce ~17,600 reconstructed actions over four days. The report argues signature-based detection is insufficient against signed-software abuse and recommends UEBA, cross-domain visibility, and automated triage (e.g., Elastic Workflows) to keep pace with machine-speed attacks.
Technical Details
- RMM abuse: 23 confirmed findings this quarter; ScreenConnect most frequently abused; one healthcare case chained a paste-and-run lure to MSI delivery with DLL sideloading in ~16 seconds.
- AI agent abuse: one intrusion involved an AI agent generating ~17,600 reconstructed actions over four days.
- Identity abuse: AiTM phishing kits and legacy authentication protocol gaps used to bypass MFA; average time from infostealer credential theft to attacker login observed at 8 minutes.
- Attackers increasingly rely on legitimate, signed first-party tools (RMM agents, AI coding assistants, Microsoft first-party clients) rather than custom malware.
Remediation
Elastic recommends deploying user and entity behavior analytics (UEBA) to baseline normal activity, cross-domain visibility and correlation across environments, and shifting detection to system-level behavioral outcomes (e.g., memory tampering, proxy tunneling) rather than signature-based approaches. Automated triage pipelines combining telemetry, deterministic rules and AI reasoning (e.g., Elastic Workflows) are suggested to manage the resulting alert volume and keep pace with attack speed.