VULNpocalypse
InformationalEcosystem changeMonitoring

Elastic report says attackers log in 8 minutes after infostealer hit

Help Net Security reports Elastic says attackers logged in about 8 minutes after infostealer infections; review remote tools and sign-in methods.

Published
Exploitation
Yes, according to Elastic as reported by Help Net Security, in confirmed customer cases; no independent verification

What happened

According to Help Net Security, a report from Elastic Security Threat Command says attackers logged in with stolen credentials an average of eight minutes after infection, across 27 confirmed infostealer cases. This is Elastic’s account as relayed by one outlet. We have not seen the underlying report, and no independent verification is cited.

Help Net Security says Elastic’s researchers also documented the following:

  • AI applications used to run commands. Elastic reports intrusions involving Claude Code on Windows and the ChatGPT desktop application on macOS. In the Windows case, an attacker connected remotely and used Claude Code through its Visual Studio Code extension to prepare tools and reach an outside server through a concealed connection. On macOS, commands run through the ChatGPT desktop application read an internal infrastructure document and then accessed the user’s saved password store. Help Net Security notes these were misuse after access was obtained, and do not establish a vulnerability in the applications or a compromise of their providers.
  • Trusted software abused for theft. Across the 27 cases, Elastic says investigators saw theft operating through applications the user or system already trusted, including a signed remote monitoring agent, a browser updater, a vendor installer and Apple’s scripting utilities.
  • ClickFix-style pages as the most common entry. Elastic reports these pages appeared in 12 cases. In one healthcare case, Help Net Security says a malicious installer was delivered and run through DLL sideloading about 16 seconds after the user followed the lure.
  • Remote monitoring and management tools. Elastic says it confirmed 23 cases of abuse, with ScreenConnect named most often. Help Net Security describes one campaign that began with a fake digital invitation and led to a hidden ScreenConnect installation running as a Windows service.
  • Phishing against sign-in services. Elastic says Tycoon 2FA, an adversary-in-the-middle kit, remained in active use during the reporting period. It also reports attackers submitting stolen usernames and passwords through an older authentication method that allowed access without a second factor, and a device-code phishing case that ended with a virtual device being registered for continued access.

Not confirmed in the source: the names of affected organisations, the total number of cases beyond those cited, the reporting period dates, and any vendor response. No CVEs are cited.

Am I affected?

The source does not name specific affected versions or products with flaws. Per Elastic’s findings as reported by Help Net Security, the exposure is to these patterns:

  • Windows or macOS users who can be persuaded to paste and run a command from a verification page.
  • Environments where remote monitoring and management tools such as ScreenConnect can be installed or used without review.
  • Computers with AI coding assistants or desktop AI applications that can run commands and reach files and credentials.
  • Cloud accounts that accept an older authentication method without a second factor, or that allow device-code sign-in.

Whether your environment has actually been hit is not something the source can tell you; that requires your own logs.

What to do now

  1. Inventory remote monitoring and management tools in your environment and compare them with your approved list. Elastic reports abuse in 23 cases, so check for unexpected ScreenConnect installs and services.
  2. Review what AI coding assistants and desktop AI applications on user machines are doing. Elastic’s Mike Nichols is quoted by Help Net Security as saying the question is what a tool is actually doing, not only whether it is approved.
  3. Tell users that a page asking them to copy and run a command as a “verification” or troubleshooting step is a known lure pattern, according to Elastic’s report as summarised by Help Net Security.
  4. Check cloud sign-in settings for older authentication methods that allow access without a second factor, as the source describes such use in observed cases.
  5. Review device-code sign-in and any newly registered devices on accounts for activity you do not recognise.
  6. Consider behaviour baselining across endpoint, identity and cloud data. The report’s authors, per Help Net Security, recommend user and entity behavior analytics (UEBA) and cross-domain correlation rather than signatures alone.

Sources