New research from Elastic Security Threat Command indicates that attackers are leveraging stolen credentials with alarming speed, logging into compromised systems an average of just eight minutes after an initial infection. This finding, based on an analysis of 27 confirmed cases involving infostealer malware, highlights a shift toward exploiting trusted software and legitimate user behavior to bypass traditional security perimeters.
The investigation reveals that infostealers are increasingly effective at harvesting browser session data, saved passwords, and payment information. Once these credentials are obtained, attackers frequently use them to access cloud accounts or internal systems. In several instances, the use of adversary-in-the-middle phishing kits, such as Tycoon 2FA, allowed attackers to intercept authentication tokens, enabling them to bypass multifactor authentication by hijacking active sessions.
A significant portion of these intrusions relies on social engineering tactics like ClickFix-style verification pages. In these scenarios, users are tricked into manually executing malicious commands under the guise of troubleshooting or security verification. Because the user initiates the process, these attacks often evade email-based security filters. One documented case in the healthcare sector demonstrated how rapidly these tactics can succeed, with a malicious installer executing via DLL sideloading only 16 seconds after the user interacted with the deceptive prompt.
Beyond initial access, the report identifies a concerning trend of attackers abusing legitimate, digitally signed remote monitoring and management software to maintain persistence. Researchers confirmed 23 cases where tools like ScreenConnect were installed on victim machines to provide attackers with long-term remote access, file transfer capabilities, and the ability to execute commands as a Windows service.
The research also highlights the misuse of AI-powered coding assistants and desktop applications as a new attack surface. While these tools do not contain inherent vulnerabilities, attackers are exploiting their ability to interact with local files and system commands once they have gained a foothold on a machine. For example, attackers were observed using the Claude Code extension within Visual Studio Code on Windows to prepare malicious tools, while on macOS, the ChatGPT desktop application was manipulated to read internal infrastructure documentation and access saved password stores.
These incidents underscore that the threat is not necessarily the software itself, but rather the potential for authorized applications to be weaponized by an attacker who has already compromised a user's session. When an attacker operates through a trusted application, their activity often mimics the behavior of the legitimate user, making detection significantly more difficult for standard security tools.
The report emphasizes that relying on simple signature-based detection is no longer sufficient to combat these threats. Because attackers are operating within the context of approved software and trusted user accounts, defenders must focus on behavioral analysis. Establishing a baseline for normal user and entity activity is essential to identifying anomalies that occur when an account or application is being misused.
Ultimately, the findings suggest that the security industry must prioritize cross-domain visibility and active correlation across the entire environment. By monitoring how applications interact with sensitive data and tracking unusual command execution patterns, organizations may be better positioned to detect the presence of an intruder before they can fully exploit a compromised session.
