Hackers Exploit Stolen Credentials in Minutes, Leverage AI and Remote Tools for Access
Attackers can gain access to systems using stolen credentials in an average of just eight minutes, according to new analysis from Elastic Security Threat Command.
Cybercriminals are achieving alarmingly rapid access to victim systems, with an average of just eight minutes elapsing between the compromise of credentials and their successful use to log in. This stark finding comes from an analysis of 27 infostealer cases conducted by Elastic Security Threat Command, highlighting a critical window of vulnerability for organizations.
The report also sheds light on sophisticated tactics employed by attackers, including the misuse of artificial intelligence applications for command execution and the abuse of digitally signed remote monitoring tools to establish persistent access. These methods allow attackers to blend in with legitimate user activity, making detection significantly more challenging.
Researchers observed attackers leveraging AI coding assistants like Claude Code and Cursor to execute system commands. The inherent capabilities of these tools, which allow interaction with files, credentials, and other applications, provide attackers with a pathway to operate through software already installed for legitimate business purposes. Cases involving Claude Code on Windows and the ChatGPT desktop application on macOS demonstrated how attackers could prepare tools, establish concealed connections to external servers, and access sensitive user data like saved passwords.
It is important to note that these instances represent the misuse of AI applications after attackers gained initial access, and do not indicate vulnerabilities within the AI applications themselves or compromises of their providers. The core issue remains the compromised credentials that grant initial entry.
Beyond AI, the analysis revealed that attackers frequently utilize trusted applications and services to maintain their foothold. This includes the abuse of remote monitoring and management (RMM) software, which is commonly used by IT departments for legitimate remote access. Attackers can exploit the capabilities of these tools to control devices, deploy additional malware, and exfiltrate data. The report confirmed 23 cases involving the abuse of such applications, with ScreenConnect being frequently named.
Compromised credentials are often obtained through infostealers, which are designed to collect a wide range of sensitive information, including saved passwords, browser session data, and payment details. The report identified ClickFix-style verification pages as a prevalent entry point, tricking users into executing malicious commands presented as verification steps. This method can bypass traditional defenses that focus on email attachments, as the user directly initiates the malicious action.
Furthermore, attackers are increasingly employing Adversary-in-the-Middle (AiTM) phishing kits to bypass multi-factor authentication. These kits create a relay between the victim and the legitimate login page, capturing credentials and session data even after the user completes MFA. The report also noted the use of older authentication methods that allowed access without a second factor, and device-code phishing techniques that trick users into approving attacker-initiated login sessions.
"An agent that holds credentials and can reach the internet is a new attack surface, whether it’s misconfigured or abused," stated Mike Nichols, General Manager, Security at Elastic. "When an attacker is behind it, its activity looks exactly like the employee who installed it. So the question for defenders isn’t whether a tool is approved; it’s what that tool is actually doing."