Elastic’s Threat Report Reveals Attackers Are Turning Trusted AI and IT Tools Against the Enterprises That Deploy Them
Business Wire•04/11/2026•09:00 ET
0
Key Highlights
- ➤Eight-minute average from infection to stolen-credential login in 27 confirmed cases
- ➤23 cases involved attackers installing legitimate remote IT software, most often ScreenConnect
- ➤12 of 27 cases began with ClickFix lures, representing 44% of incidents
- ➤Attackers executed commands through Claude Code on Windows and ChatGPT desktop on macOS
- ➤Elastic (ESTC) released quarterly threats, etc report based on confirmed live intrusions
Expert Statements
Mike Nichols, General manager, Security, Elastic
“Attackers hiding inside trusted software isn’t new. Defenders have been fighting living-off-the-land techniques for decades, and MITRE ATT&CK has an entire tactic built around it.”
Mike Nichols, General manager, Security, Elastic
“What’s new is that enterprises are increasingly deploying powerful trusted tools that most security teams struggle to fully monitor, control, or even explain: AI agents.”
Mike Nichols, General manager, Security, Elastic
“An agent that holds credentials and can reach the internet is a new attack surface, whether it’s misconfigured or abused.”
Mike Nichols, General manager, Security, Elastic
“When an attacker is behind it, its activity looks exactly like the employee who installed it.”
Mike Nichols, General manager, Security, Elastic
“So the question for defenders isn’t whether a tool is approved; it’s what that tool is actually doing.”
Elastic’s Threat Report Reveals Attackers Are Turning Trusted AI and IT Tools Against the Enterprises That Deploy Them
Attackers are putting legitimate software to illegitimate use: executing commands through AI agents, abusing trusted IT tools, and using stolen credentials in minutes
Get started
Create a free account to read the full story.