Elastic says threat actors are increasingly using trusted AI and IT tools to blend into enterprise environments, including executing commands through AI applications such as Claude Code on Windows and ChatGPT desktop on macOS.
In its latest quarterly “Threats, etc.” report, produced by Elastic Security Threat Command, the company said it observed confirmed intrusions between April and September 2026 where attackers leveraged approved software and system-level access to run commands, harvest credentials and maintain persistence using legitimate remote monitoring tools.
Elastic said it found attackers logged in using stolen credentials an average of eight minutes after infection across 27 confirmed cases involving password-stealing malware. The company also said that in one healthcare case, malware was delivered 16 seconds after a user followed a malicious lure.
The report points to “ClickFix” social engineering prompts—fake messages designed to trick users into copying and running commands—as a common initial access method, cited as the starting point in 12 of the 27 cases (44%). Elastic said follow-on activity often ran within software already trusted on the device, including browser updaters and built-in scripting tools on macOS.
Elastic also reported observing live intrusions where commands were executed through AI tools already installed on victim machines. In one macOS intrusion described in the report, Elastic said a single command accessed an internal infrastructure document and then retrieved saved passwords from the user’s keychain. In another case, Elastic said an attacker remotely connected to a Windows device and used Claude Code to stage tools and reach an external server via a concealed connection.
“Attackers hiding inside trusted software isn’t new. Defenders have been fighting living-off-the-land techniques for decades, and MITRE ATT&CK has an entire tactic built around it,” said Mike Nichols, general manager, Security, Elastic.
“What’s new is that enterprises are increasingly deploying powerful trusted tools that most security teams struggle to fully monitor, control, or even explain: AI agents. An agent that holds credentials and can reach the internet is a new attack surface, whether it’s misconfigured or abused. When an attacker is behind it, its activity looks exactly like the employee who installed it. So the question for defenders isn’t whether a tool is approved; it’s what that tool is actually doing.”
The findings add to ongoing industry debate about the security implications of deploying AI agents with broad permissions. Elastic argued defenders face a trade-off between alerting on large volumes of AI-tool activity or accepting risk by trusting such tools by default.
Beyond AI agents, Elastic said it confirmed 23 cases in which attackers installed legitimate remote IT software to retain hands-on access, most often ScreenConnect.
Elastic recommended organisations inventory AI tools, signed software and IT tools they trust, and assess them based on behaviour rather than approval status, including what processes are launched and where remote tools connect. It also advised baselining normal activity and correlating signals across cloud, endpoint and identity data.
Elastic said “Threats, etc.” replaces its annual Global Threat Report and will be published quarterly, with each edition focusing on notable techniques and confirmed findings rather than prevalence estimates.
You can read the full report here.
