Elastic Report Finds Attackers Exploit Trusted AI Tools to Execute Commands

• Elastic’s cybersecurity report found attackers exploiting trusted AI and IT tools, based on intrusions and research from April through September 2026.
• Attackers executed commands through Claude Code on Windows and ChatGPT desktop on macOS, exploiting enterprise trust in AI applications.
• Stolen credentials were used within eight minutes on average across 27 confirmed malware cases; ClickFix lures initiated 12 cases, or 44%.
• Researchers confirmed 23 cases involving legitimate remote IT software used to maintain access, most often ScreenConnect.
• The report recommends monitoring trusted software’s behavior rather than relying on authorization status, with coordinated detection across cloud, endpoint and identity data.

Disclaimer: This news brief was created by Public Technologies (PUBT) using generative artificial intelligence. While PUBT strives to provide accurate and timely information, this AI-generated content is for informational purposes only and should not be interpreted as financial, investment, or legal advice. Elastic NV published the original content used to generate this news brief via Business Wire (Ref. ID: 202611040900BIZWIRE_USPR_____20261104_BW188457) on November 04, 2026, and is solely responsible for the information contained therein.