Hackers abuse trusted AI tools to breach organisations

Elastic has published a threat report on how attackers are using trusted AI and IT tools to compromise organisations. The findings are based on confirmed live intrusions and first-party research.

According to the report, attackers are exploiting the deep access enterprises give approved software, including AI agents, remote monitoring products and built-in system tools. Researchers observed intruders executing commands through Claude Code on Windows and ChatGPT desktop on macOS, while also using stolen credentials within minutes of infecting a device.

Across 27 confirmed cases involving password-stealing malware, the average time between infection and login with stolen credentials was eight minutes. In 12 of those cases, or 44%, the initial compromise began with a ClickFix lure, which uses a fake prompt to trick users into pasting and running a malicious command themselves.

One healthcare case showed how quickly an attack can progress. Malware was delivered 16 seconds after a user interacted with a malicious lure.

The research adds to growing scrutiny of workplace AI tools, particularly those that hold credentials or have broad access to internal systems and internet services. Security teams have historically focused on whether software is approved, but the report argues that this matters less when trusted applications can be turned into vehicles for malicious actions.

"Attackers hiding inside trusted software isn't new. Defenders have been fighting living-off-the-land techniques for decades, and MITRE ATT&CK has an entire tactic built around it," said Mike Nichols, general manager, security, Elastic.

"What's new is that enterprises are increasingly deploying powerful trusted tools that most security teams struggle to fully monitor, control, or even explain: AI agents. An agent that holds credentials and can reach the internet is a new attack surface, whether it's misconfigured or abused. When an attacker is behind it, its activity looks exactly like the employee who installed it. So the question for defenders isn't whether a tool is approved; it's what that tool is actually doing," Nichols said.

AI tool misuse

Researchers observed one macOS intrusion in which a single command read an internal infrastructure document and then pulled saved passwords from the user's keychain. In another case on Windows, an attacker remotely connected to a machine, used Claude Code to stage tools and reached an outside server through a concealed connection.

These incidents reflect a wider challenge for defenders trying to distinguish between normal AI-assisted workflows and malicious activity. If an employee or administrator has granted an AI tool broad permissions, its actions may appear legitimate in logs and monitoring systems.

The report also points to signs that AI agents can sustain attacks at machine speed. They can carry out thousands of actions with limited human intervention and continue operating through errors and failed attempts.

As part of its research, Elastic conducted a forensic reconstruction of the Hugging Face breach in July 2026. Indicators of AI agent involvement included duplicate commands issued seconds apart and a successful exploit followed immediately by a basic coding error.

Trusted software

Beyond AI applications, attackers are continuing to rely on legitimate IT administration tools to maintain access to compromised devices. Elastic confirmed 23 cases in which intruders installed remote IT software for hands-on access, with ScreenConnect appearing most often.

That pattern fits a broader trend in cyber intrusions, with attackers seeking to blend into ordinary system administration activity rather than rely solely on bespoke malware. Signed software, browser updaters and native operating system tools can all provide cover because they already carry a level of trust inside corporate environments.

The theft activity Elastic tracked often continued inside software devices already trusted, including browser updaters and Apple's built-in scripting tools. This creates a detection problem for security teams because the software itself may not trigger suspicion, even when the behaviour around it does.

Detection advice

The report recommends that defenders create a clear inventory of approved AI tools, IT tools and signed software, and treat anything outside that list as suspect. Teams should also assess trusted software by its behaviour, such as what an AI application launches or where a remote administration tool connects, rather than by approval status alone.

Elastic added that organisations should build baselines of normal activity across systems and correlate signals from cloud, endpoint and identity data. The report is part of a quarterly series focused on notable techniques and confirmed findings rather than broader estimates of prevalence.

The figures cover research and confirmed intrusions observed between April and September 2026. They also include published artefacts and detection logic intended to help defenders identify similar activity in their own environments.