Elastic Security Labs published its November 2026 quarterly threat report, “threats, etc,” on 4 November 2026; Elastic’s own blog introduces it as “When trust becomes the payload.” Elastic Threat Command wrote it from confirmed customer intrusions and first-party research between 4 April and 8 September 2026. Its central finding is trusted software abuse, where attackers run full intrusions inside signed, legitimate tools instead of custom malware.
Elastic frames the shift in plain terms. Defenders trust an AI coding assistant because it sits on the approved software list. They trust an RMM tool because IT installed it, and a first-party sign-in client because the vendor ships it. Elastic Threat Command says attackers now use exactly that trust against defenders, inside live customer environments.
- 27Confirmed infostealer findings on customer endpointsSource: Elastic Security Labs, threats etc, November 2026
- 23Confirmed RMM-tool abuse findings, ScreenConnect named most oftenSource: Elastic Security Labs, threats etc, November 2026
- 8 minutesAverage time from infostealer infection to the same-credential loginSource: Elastic Security Labs, threats etc, November 2026
- 17,600Reconstructed actions in one AI agent-driven attack, over four daysSource: Elastic Security Labs, threats etc, November 2026
How the 27 Infostealer Cases Got In
Across those 27 confirmed infostealer findings, Elastic threat hunting kept finding theft running inside something the device already trusted. The list includes a signed remote monitoring agent, a browser updater, a vendor installer and Apple’s own scripting utilities. ClickFix-style fake verification pages were the dominant entry point. They walk a victim into pasting one command into the Windows Run dialog.
Speed stood out once an infection landed. In one confirmed healthcare case, Elastic says the move from a pasted command to Microsoft Software Installer delivery with DLL sideloading took about 16 seconds. Elastic Threat Command has also observed that the average time from a ClickFix infostealer infection to the attacker’s own login, using the same stolen credentials, is only eight minutes.
One documented chain ran through a remote-monitoring executable signed with a revoked certificate. The signature was present, Elastic says, but the trust chain behind it was not. That is the state a simple is-it-signed check will not catch.
AI Coding Assistants Used as Execution Proxies
Elastic also documents AI applications acting as the attacker’s own execution layer. On a Windows endpoint on 5 August 2026, Elastic threat hunting confirmed an operator driving the Claude Code coding assistant through its VS Code extension. The operator used it to stage tooling and reach a self-hosted code repository, routed through a proxy tunnel. Elastic Defend rules fired on the command-line activity this chain produced.
Five days later, on macOS, Elastic confirmed a separate case. The ChatGPT desktop application acted as a shell command proxy for credential access, running a built-in macOS command that reads stored keychain secrets. Elastic Threat Command says it saw similar patterns in two more macOS coding-agent cases. Those sessions started with permission-bypass flags and installed their own persistence.
A fourth AI-driven case shows the scale this activity can reach. Threat hunting tied a Hugging Face dataset-processing flaw to an intrusion that moved from credential discovery to cluster secret harvesting. It then moved laterally across internal clusters over four days, totaling roughly 17,600 reconstructed actions. Elastic says duplicate commands executed seconds apart, and task identifiers left in logs, are strong signs of this kind of AI-driven activity.
RMM Abuse and the Identity Bypass Behind It
Elastic threat hunting confirmed 23 RMM-tool abuse findings between 15 June and 12 August 2026. They arrived through phishing pages or archive lures carrying script droppers. ScreenConnect was the product Elastic named most often, and healthcare endpoints appeared in three separate confirmations.
On identity, Elastic describes adversary-in-the-middle phishing kits that place a reverse proxy between the victim and the real login page. The victim completes a genuine MFA challenge while the relay steals the resulting session. Tycoon 2FA, a kit Microsoft attributes to the group Storm-1747, remains in active use after a March 2026 seizure of more than 300 domains. Elastic says it can issue a primary refresh token within minutes of credential submission.
A separate identity finding involved device-code phishing. A victim is talked into approving a sign-in code that hands the attacker’s client a valid access token. Elastic also documented legacy authentication abuse that bypassed Conditional Access Policies entirely, since that older sign-in flow never passes through the surface those policies govern.
What Brandefense Blackhole Shows About ClickFix and ScreenConnect
Brandefense Blackhole, our own monitoring of dark web and Telegram channels, logged 468 posts mentioning ClickFix since 11 August 2026. It logged 543 posts mentioning ScreenConnect over the same window, based on our own reading of the posts.
The counts show that both techniques Elastic names have an active underground market of their own. That includes the pasted-command lure and ScreenConnect-style remote access abuse, separate from Elastic’s own customer telemetry.
Why Signature-Based Detection Misses Trusted Software Abuse
A hash or signature check cannot catch a tool it was built to trust. Elastic’s report says defenders need user and entity behavior analytics to baseline normal activity, plus cross-domain visibility and active correlation. Elastic adds that one attack chain now crosses containers, cloud control planes, legitimate users and legitimate software. Telling benign activity from malicious activity is harder than before.
On identity, Elastic recommends continuous session monitoring rather than trusting a login event once it has happened. A valid session token is not proof that the right person is still behind it. We would add one practical step: treat a jump in RMM tool installs, especially ScreenConnect, as a trigger for a focused behavior review. Patch management alone will not catch a tool that was never vulnerable to begin with.
Elastic’s numbers come from confirmed customer intrusions and first-party research gathered between 4 April and 8 September 2026. The report publishes quarterly instead of annually to keep pace with AI-assisted offense. Elastic notes that a count of findings is not a count of victims, since several findings can share one host or tenant. The report favors notable tradecraft over raw telemetry counts.
Frequently Asked Questions
What does Elastic mean by trusted software abuse?
It is our term for what Elastic's report calls signed software abuse: full intrusions inside signed, legitimate tools like AI assistants and RMM software, not custom malware.
How fast did Elastic see attackers log in after an infostealer infection?
Elastic Threat Command says the average time from a ClickFix infostealer infection to the attacker's own login, using the same credentials, is eight minutes.
Which AI tools did Elastic see used as execution proxies?
Elastic documented the Claude Code VS Code extension on Windows and the ChatGPT desktop application on macOS, both run to execute commands on the attacker's behalf.
Which RMM tool did Elastic name most often?
ScreenConnect, named most often among 23 confirmed RMM-tool abuse findings Elastic's threat hunting confirmed between 15 June and 12 August 2026.
