Hackers log in with stolen credentials in average 8 minutes
Original title: An average of 8 minutes is all hackers need to log in with stolen credentials
Attackers access systems in an average of 8 minutes using stolen credentials in 27 confirmed cases, abusing AI coding tools and remote monitoring software.
Elastic Security Threat Command analyzed 27 cases where attackers used stolen credentials to log in an average of 8 minutes after infection. They documented misuse of AI applications such as Claude Code on Windows and the ChatGPT desktop app on macOS to execute commands. Remote monitoring tools like ScreenConnect were abused in 23 cases, often installed via phishing or ClickFix pages.
Unconfirmed: No specific products or versions mentioned; general report on observed tactics
- Attackers log in an average of 8 minutes post-infection across 27 cases
- Claude Code used for command execution on Windows
- ChatGPT desktop app on macOS for reading documents and accessing password stores
- ScreenConnect most common remote tool abused
- ClickFix-style pages used in 12 cases as entry point
Impact: Initial access via stolen credentials and abuse of trusted software applications
- 1.Implement user and entity behavior analytics to detect abuse of trusted tools
- Vendors
- Elastic
- Malware
- infostealer
From the original article
3 min read at helpnetsecurity.com
Attackers used stolen credentials to log in an average of eight minutes after infection across 27 confirmed infostealer cases, according to a report from Elastic Security Threat Command. Researchers also documented misuse of AI applications to execute commands and digitally signed remote monitoring tools to maintain access.
By Anamarija Pogorelec · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.