Elastic warns attackers abuse trusted AI tools in hacks

Elastic has published research showing that attackers are abusing trusted software tools, including AI applications and remote IT products, during live intrusions. Stolen login details were used an average of eight minutes after infection.

The findings focus on software that organisations and employees already view as legitimate, including browser updaters, signed remote monitoring tools and Apple scripting utilities, as well as desktop AI products such as Claude Code and ChatGPT.

In observed intrusions, attackers executed commands through Claude Code on Windows and the ChatGPT desktop app on macOS. In one macOS case, a single command read an internal infrastructure document before pulling saved passwords from the user's keychain.

The pattern reflects a shift in how attackers exploit trust in approved software rather than relying only on obviously malicious programs. Defenders can struggle to distinguish between normal activity from AI agents or administrative tools and malicious use of the same applications.

Speed of misuse

Elastic examined 27 confirmed cases involving information-stealing malware on customer devices. In 12, the initial access method was a so-called ClickFix lure, in which a fake prompt tricks a user into pasting and running a command.

One healthcare case showed how quickly an incident can develop. Malware was delivered about 16 seconds after the user responded to the lure.

Once a device was infected, attackers moved quickly to exploit stolen credentials. The average time between infection and login using stolen details was eight minutes.

The study covered confirmed live intrusions and first-party research between April and September 2026. It focused on specific techniques observed in incidents rather than broad telemetry totals.

AI tools

The report highlights AI applications as points for command execution rather than the source of a new type of attack. The issue is the misuse of legitimate software that may already have access to credentials, files and internet connections inside a company environment.

In one Windows intrusion, an attacker remotely connected to a machine, used Claude Code to stage tools and reached an external server through a concealed connection. The report presents this as part of a wider challenge for security teams increasingly expected to oversee software with broad access to internal systems.

Mike Nichols, General manager, Security, at Elastic, said the problem builds on a long-established tactic. "Attackers hiding inside trusted software isn't new. Defenders have been fighting living-off-the-land techniques for decades, and MITRE ATT&CK has an entire tactic built around it," he said.

He said the spread of AI agents changes the scale and visibility of that risk. "What's new is that enterprises are increasingly deploying powerful trusted tools that most security teams struggle to fully monitor, control, or even explain: AI agents. An agent that holds credentials and can reach the internet is a new attack surface, whether it's misconfigured or abused. When an attacker is behind it, its activity looks exactly like the employee who installed it. So the question for defenders isn't whether a tool is approved; it's what that tool is actually doing," Nichols said.

Persistent access

Elastic also said attackers continue to rely on legitimate remote IT software to maintain access to compromised devices. It confirmed 23 cases in which attackers installed lawful remote administration products for hands-on control, most often ScreenConnect.

The tactic mirrors a wider cyber security trend in which signed and widely used applications can provide cover for hostile activity. For employers, the issue is less whether software is on an approved list than whether its behaviour matches expected patterns.

The research also examined a separate intrusion involving an AI agent and a Kubernetes cluster. Elastic reconstructed 17,600 actions in the incident, at roughly one action every 20 seconds, over four uninterrupted days.

The sequence of the intrusion was not unusual, but the sustained pace stood out. Indicators that an AI agent may have been involved included duplicate commands issued seconds apart and a successful exploit followed immediately by a basic coding error.

The findings come as organisations across Europe face growing concern over attempts to disrupt everyday services through cyber attacks. Elastic's report suggests that, for defenders, one of the central problems is that familiarity with an application is no longer a reliable guide to whether activity is safe.

Elastic said security teams should track which AI tools, IT tools and signed software are trusted in their environments, assess those tools by behaviour rather than approval status, and correlate signals across cloud, endpoint and identity systems.