Infostealer Attacks Log In Within Eight Minutes
Elastic Security Threat Command documented 27 confirmed infostealer cases in which attackers reused stolen credentials quickly after infection.
Updated on Nov. 9, 2026 in Cybersecurity
Live Poll
Do you trust the security of the AI and remote tools your work computer uses?
Elastic Security Threat Command reported 27 confirmed infostealer cases on customer computers, with attackers logging in using stolen credentials an average of eight minutes after infection. Researchers also documented misuse of AI applications, including Claude Code on Windows and the ChatGPT desktop application on macOS.
Why it matters
The short gap between infection and login leaves defenders little time to respond once credentials are stolen. Abuse of legitimate AI tools and remote management software makes malicious activity harder to distinguish from normal use.
Elastic Security Threat Command confirmed 27 infostealer cases, and attackers logged in an average of eight minutes after infection. Researchers did not report how many infections went undetected, so the full scale of activity remains unclear.
The players
Elastic Security Threat Command
Elastic's security research team that tracks threats and documented the infostealer cases described in this report.
Tycoon 2FA
An adversary-in-the-middle phishing kit used to steal login credentials and session tokens, which remained in active use during the period.
The details
ClickFix-style verification pages were the most common entry point, appearing in 12 cases. In one healthcare case, a malicious installer was delivered and executed about 16 seconds after the user followed the lure, and a device-code phishing case persuaded a user to enter a code on Microsoft's sign-in page.
Timeline
Tycoon 2FA phishing kit remained in active use during the reporting period.
In one healthcare case, malicious installer execution occurred about 16 seconds after the lure was followed.
Attackers logged in an average of eight minutes after infection.
Threat Landscape
Attackers are increasingly abusing legitimate tools such as Claude Code, the ChatGPT desktop application, and remote monitoring software like ScreenConnect. This pattern means that security teams must treat trusted AI and remote-access applications as potential intrusion vectors rather than assuming their use is benign.
Users should be cautious of verification pages that prompt them to run commands or enter device codes, since these were common entry points in the reported cases. Organizations should review which remote monitoring and AI applications are permitted on their systems and monitor for unexpected connections.
The takeaway
Stolen credentials can be exploited within minutes, so protections such as multi-factor authentication and rapid session monitoring matter more than assuming a slow response window. Treat legitimate tools as potential attack paths when reviewing your own security posture.
Further reading
Explore more threat research in Cybersecurity coverage.
Source note: This article includes information reported by Help Net Security.
Live Poll
Do you trust the security of the AI and remote tools your work computer uses?
