Science & Tech · Cybersecurity · 12 hrs ago
Hackers used stolen credentials within eight minutes on average
Attackers used stolen credentials an average of eight minutes after infection in 27 confirmed cases on customer computers.
The findings come from Elastic Security Threat Command researchers, who examined infostealer attacks that collect data such as saved passwords and browser sessions.
ClickFix-style pages were the most common entry point, appearing in 12 cases; they trick people into copying and running a malicious command.
In other cases, attackers used AI applications such as Claude Code and ChatGPT to run commands, read documents or access saved passwords after gaining access to a device.
Researchers also confirmed 23 cases of remote IT software abuse, which can let an attacker control a computer and install more tools.
Stolen browser sessions can let attackers use accounts without entering a password again, and phishing kits can capture sessions even after a victim completes multifactor authentication.
The findings show how attackers can misuse trusted tools and services, but the cases do not establish that the AI apps had vulnerabilities or that their providers were compromised.
Attackers used stolen credentials to log in an average of eight minutes after infection across 27 confirmed infostealer cases, according to an Elastic Security Threat Command report.
Researchers found attackers misused AI applications and digitally signed remote monitoring tools to carry out commands and maintain access.
ClickFix-style verification pages were the most common entry point, appearing in 12 cases.
Researchers confirmed 23 cases involving abuse of remote monitoring and management applications.
The report said the cases involved misuse after attackers gained access and did not show that the AI applications had vulnerabilities or that their providers were compromised.
- Who
- Attackers used stolen credentials and misused software to access computers and accounts.
- What
- A report found that attackers logged in an average of eight minutes after infection across 27 confirmed infostealer cases.
- When
- The report was published on 2026-11-09. The time period covered by the findings is not stated.
- Where
- The cases involved customer computers, including Windows and macOS devices. Specific locations are not stated.
- Why
- Attackers used stolen credentials and trusted applications to access accounts, run commands and maintain access.
This story does not have two clearly opposing sides.
In one healthcare case, a malicious installer was delivered and executed through DLL sideloading.
Attackers used stolen credentials to log in across 27 confirmed infostealer cases.
- Confirmed infostealer cases
- 27
- Average time to credential-based login
- Eight minutes after infection
- ClickFix-style entry points
- 12 cases
- Remote monitoring and management abuse
- 23 confirmed cases
- Healthcare case
- Malicious installer delivery and DLL sideloading occurred about 16 seconds after the user followed the lure
What people are saying
An agent that holds credentials and can reach the internet is a new attack surface, whether it’s misconfigured or abused.
When an attacker is behind it, its activity looks exactly like the employee who installed it.
So the question for defenders isn’t whether a tool is approved; it’s what that tool is actually doing,