Elastic Warns of Attackers Abusing Trusted Software
Original title: When trust becomes the payload: Inside the threats, etc quarterly report
Elastic's November report details how adversaries weaponize legitimate RMM tools, AI coding assistants, and first-party applications for persistent access.
Elastic Security Labs observed attackers abusing trusted enterprise software in intrusions between April and September 2026. ScreenConnect was the most named RMM tool, with AI agents and Microsoft clients also used for quick execution. The report emphasizes shifting to behavioral detection since signatures fail against signed legitimate tools.
- No malware used; signed legitimate products as payloads.
- RMM abuse findings include rapid 16-second attacks.
- AI agent attacks compress many actions into days.
- Time from infostealer to credential use averages 8 minutes.
Impact: Persistent access via trusted RMM and AI tools
- Vendors
- Elastic
From the original article
4 min read at elastic.co
The newest threats, etc report details how adversaries are weaponizing trust across the entire enterprise stack, abusing everything from AI assistants and npm supply chains to identity flows and legitimate management tools.
By Terrance DeJesus,Jason Pappalexis,Andrew Pease · elastic.co
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.