Elastic reports attackers logging in 8 minutes after infostealer infection, abusing AI coding assistants and signed RMM tools
A report from Elastic Security Threat Command finds that attackers used stolen credentials to authenticate an average of eight minutes after infection across 27 confirmed infostealer cases on customer endpoints. Theft was carried out through already-trusted software — a signed remote monitoring agent, a browser updater, a vendor installer and Apple's scripting utilities — rather than through unsigned binaries. ClickFix-style verification pages were the most common entry point, seen in 12 cases, persuading users to paste and run a malicious command themselves and so bypassing attachment-scanning defences. Researchers additionally documented 23 cases of abuse of remote monitoring and management (RMM) software, with ScreenConnect named most often, and intrusions in which attackers ran commands through AI coding assistants (Claude Code on Windows, the ChatGPT desktop application on macOS). Elastic states these AI cases were post-compromise misuse and do not indicate a vulnerability in, or compromise of, those applications.
Detalhes técnicos
- Infostealers: collect saved passwords, browser session data and payment details; captured session cookies let attackers reuse accounts without re-entering a password (session hijacking).
- Speed: in one healthcare case, a malicious installer was delivered and executed via DLL sideloading roughly 16 seconds after the user followed the ClickFix lure.
- AI application abuse: on Windows, an attacker with remote access used Claude Code through its Visual Studio Code extension to stage tooling and reach an external server over a concealed connection; on macOS, commands run through the ChatGPT desktop application read an internal infrastructure document and then accessed the user's saved password store.
- RMM abuse: phishing pages and archives containing malicious scripts led to installs; one campaign used a fake digital invitation to silently install ScreenConnect, which beaconed to an attacker-controlled server and ran as a Windows service. In another case an attacker uploaded remote access software to a compromised server after failing to create user accounts.
- Identity attacks: AiTM phishing kits, including Tycoon 2FA (still in active use during the reporting period), relayed victims to the real login page and captured the authenticated session after MFA. Attackers also replayed stolen credentials through a legacy authentication method that permitted access without a second factor. A separate device-code phishing case tricked a user into entering a code on Microsoft's sign-in page, granting the attacker a session; follow-on activity included registering a virtual device for persistence.
Remediação
Elastic's authors argue signatures alone are insufficient when activity occurs inside trusted software or on behalf of trusted users, and recommend UEBA baselining of normal activity plus cross-domain visibility and active correlation. Practical controls implied by the findings: inventory and allow-list RMM agents, disable legacy/basic authentication and device-code flows where not required, bind sessions and shorten token lifetimes to blunt cookie theft, and monitor what AI coding assistants with credential and shell access actually execute.
Linha do tempo
-
Elastic reports attackers logging in 8 minutes after infostealer infection, abusing AI coding assistants and signed RMM tools
ler a análise desta fonte ocultar
A report from Elastic Security Threat Command finds that attackers used stolen credentials to authenticate an average of eight minutes after infection across 27 confirmed infostealer cases on customer endpoints. Theft was carried out through already-trusted software — a signed remote monitoring agent, a browser updater, a vendor installer and Apple's scripting utilities — rather than through unsigned binaries. ClickFix-style verification pages were the most common entry point, seen in 12 cases, persuading users to paste and run a malicious command themselves and so bypassing attachment-scanning defences. Researchers additionally documented 23 cases of abuse of remote monitoring and management (RMM) software, with ScreenConnect named most often, and intrusions in which attackers ran commands through AI coding assistants (Claude Code on Windows, the ChatGPT desktop application on macOS). Elastic states these AI cases were post-compromise misuse and do not indicate a vulnerability in, or compromise of, those applications.
Technical Details
- Infostealers: collect saved passwords, browser session data and payment details; captured session cookies let attackers reuse accounts without re-entering a password (session hijacking).
- Speed: in one healthcare case, a malicious installer was delivered and executed via DLL sideloading roughly 16 seconds after the user followed the ClickFix lure.
- AI application abuse: on Windows, an attacker with remote access used Claude Code through its Visual Studio Code extension to stage tooling and reach an external server over a concealed connection; on macOS, commands run through the ChatGPT desktop application read an internal infrastructure document and then accessed the user's saved password store.
- RMM abuse: phishing pages and archives containing malicious scripts led to installs; one campaign used a fake digital invitation to silently install ScreenConnect, which beaconed to an attacker-controlled server and ran as a Windows service. In another case an attacker uploaded remote access software to a compromised server after failing to create user accounts.
- Identity attacks: AiTM phishing kits, including Tycoon 2FA (still in active use during the reporting period), relayed victims to the real login page and captured the authenticated session after MFA. Attackers also replayed stolen credentials through a legacy authentication method that permitted access without a second factor. A separate device-code phishing case tricked a user into entering a code on Microsoft's sign-in page, granting the attacker a session; follow-on activity included registering a virtual device for persistence.
Remediation
Elastic's authors argue signatures alone are insufficient when activity occurs inside trusted software or on behalf of trusted users, and recommend UEBA baselining of normal activity plus cross-domain visibility and active correlation. Practical controls implied by the findings: inventory and allow-list RMM agents, disable legacy/basic authentication and device-code flows where not required, bind sessions and shorten token lifetimes to blunt cookie theft, and monitor what AI coding assistants with credential and shell access actually execute.