Attackers are increasingly exploiting the trust enterprises place in approved AI applications, remote IT tools, and signed software, according to the latest report from Elastic Security Threat Command. Elastic found that attackers use AI tools to execute commands, abuse legitimate remote-monitoring software, and use stolen credentials an average of eight minutes after infection.
The report argues that security teams can no longer treat approved software as inherently safe, particularly as AI agents gain credentials, system-level access and internet connectivity.
AI tools as attack vectors
Elastic researchers observed live intrusions in which attackers executed commands through Claude Code on Windows and ChatGPT desktop on macOS. In one macOS case, a single command read an internal infrastructure document and retrieved saved passwords from the user’s keychain.
In another incident, an attacker connected remotely to a Windows machine, used Claude Code to stage tools and established a concealed connection to an external server. Elastic said such activity can resemble the actions of the employee who installed the tool, making it difficult for defenders to distinguish legitimate use from abuse.
Mike Nichols, general manager of security at Elastic, said the emergence of powerful AI agents has created a new attack surface.
Mike Nichols
“An agent that holds credentials and can reach the internet is a new attack surface, whether it’s misconfigured or abused. So the question for defenders isn’t whether a tool is approved; it’s what that tool is actually doing.” Mike Nichols
Speed of credential abuse
Across 27 confirmed cases involving password-stealing malware, Elastic found attackers logged in with stolen credentials an average of eight minutes after infection. The most common initial access method was a ClickFix lure — a fake prompt that tricks users into pasting and running a malicious command — which appeared in 12 of the 27 cases, or 44%.
In one healthcare case, malware was delivered about 16 seconds after a user fell for a malicious lure. Elastic said attackers then continued operating within software the device already trusted, including browser updaters and Apple’s built-in scripting tools.
Asia security implications
The findings are particularly relevant to Asian enterprises accelerating AI use across customer service, software development, finance and operations. As organisations deploy AI agents with access to internal systems and credentials, Elastic warns that security controls must assess behaviour rather than rely solely on software approval lists.
Elastic recommends that defenders inventory AI tools, IT tools and signed software; treat anything outside that inventory as suspect; and evaluate trusted applications based on what they launch and where they connect. It also advises baselining normal activity and correlating signals across cloud, endpoint and identity data.
The report also confirmed 23 cases in which attackers installed legitimate remote IT software, most often ScreenConnect, to maintain hands-on access to compromised devices. Elastic said this reinforces the need to continuously monitor remote-access tools and AI agents operating across enterprise environments.
