[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fLokvs5gh1SyGqXwFz6h4Sh0_6doIAEUqC1fxdiuGl0M":3},{"article":4,"iocs":54,"watch_terms":83,"solutions":84,"lesson":178},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"9766d068-aec8-453e-8046-7a5de4e11346","An average of 8 minutes is all hackers need to log in with stolen credentials","an-average-of-8-minutes-is-all-hackers-need-to-log-in-with-stolen-credentials-f776bd","Attackers used stolen credentials to log in an average of eight minutes after infection across 27 confirmed infostealer cases, according to a report from Elastic Security Threat Command. Researchers also documented misuse of AI applications to execute commands and digitally signed remote monitoring tools to maintain access. “An agent that holds credentials and can reach the internet is a new attack surface, whether it’s misconfigured or abused. When an attacker is behind it, its activity … More → The post An average of 8 minutes is all hackers need to log in with stolen credentials appeared first on Help Net Security.","A report from Elastic Security Threat Command reveals attackers can gain access using stolen credentials in an average of just eight minutes. The research highlights the misuse of AI coding assistants like Claude Code and ChatGPT to execute commands, and the abuse of digitally signed remote monitoring tools to maintain access. Attackers are leveraging these methods to bypass traditional defenses by tricking users into executing malicious commands or by exploiting trusted applications.","Hackers log in using stolen credentials in an average of 8 minutes, abusing AI tools and remote access software.","https:\u002F\u002Fwww.helpnetsecurity.com\u002F2026\u002F11\u002F09\u002Felastic-businesses-remote-access-attacks-report\u002F","https:\u002F\u002Fimg.helpnetsecurity.com\u002Fwp-content\u002Fuploads\u002F2025\u002F09\u002F23124652\u002Fattack-ddos-threat-1500.webp","2026-11-09T05:00:39+00:00","2026-11-09T06:00:23.70294+00:00",8,[17,20,22,24,26,28],{"name":18,"type":19},"Claude Code","product",{"name":21,"type":19},"Cursor",{"name":23,"type":19},"ChatGPT desktop application",{"name":25,"type":19},"Visual Studio Code",{"name":27,"type":19},"ScreenConnect",{"name":29,"type":30},"Elastic","vendor","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":31,"icon":33,"name":34,"slug":35},null,"Threat Intelligence","threat-intelligence",[37,42,47,52],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":48},{"id":49,"icon":33,"name":50,"slug":51},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":53},{"id":31,"icon":33,"name":34,"slug":35},[55,58,62,65,68,71,74,77,80],{"type":51,"value":56,"context":57},"infostealer","Malware type used to steal credentials and session data.",{"type":59,"value":60,"context":61},"mitre_attack","T1059.001","Execution: PowerShell (used by Claude Code for command execution)",{"type":59,"value":63,"context":64},"T1555","Credential Access: Credentials from Password Stores (accessed via ChatGPT desktop app)",{"type":59,"value":66,"context":67},"T1105","Ingress Tool Transfer (remote monitoring tools used for access)",{"type":59,"value":69,"context":70},"T1071.001","Application Layer Protocol: Web Protocols (used by ScreenConnect to connect to attacker-controlled server)",{"type":59,"value":72,"context":73},"T1055.012","Process Injection: DLL Side-Loading (used in healthcare case)",{"type":59,"value":75,"context":76},"T1539","Steal Application Access Token (implied by session data reuse)",{"type":59,"value":78,"context":79},"T1553.004","Subvert Trust Controls: Mark-of-the-Web Bypass (implied by user execution of commands from downloaded files)",{"type":59,"value":81,"context":82},"T1003","OS Credential Dumping: OS Credential Dumping (general infostealer capability)",[29,18,21],{"controls":85,"vendors":172},[86,114,143],{"slug":87,"name":88,"problem":89,"products":90},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[91,98,106],{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":87,"product_name":95,"url":96,"description":97},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","Privileged Access Management","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fprivileged-access-management","Gives elevated rights to specific applications only where needed, so users do not need local admin accounts.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"delinea","Delinea","\u002Fvendor-logos\u002Fdelinea.png","secret-server","Delinea Secret Server","https:\u002F\u002Fdelinea.com\u002Fproducts\u002Fsecret-server","Vault for privileged credentials with discovery, rotation and session recording.",{"slug":115,"name":116,"problem":117,"products":118},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[119,127,135],{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":139,"product_name":140,"url":141,"description":142},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"slug":144,"name":145,"problem":146,"products":147},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[148,156,164],{"vendor_slug":149,"vendor_name":150,"vendor_logo":151,"product_slug":152,"product_name":153,"url":154,"description":155},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":157,"vendor_name":158,"vendor_logo":159,"product_slug":160,"product_name":161,"url":162,"description":163},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":165,"vendor_name":166,"vendor_logo":167,"product_slug":168,"product_name":169,"url":170,"description":171},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",[173],{"slug":174,"name":29,"logo_path":175,"roles":176},"elastic","\u002Fvendor-logos\u002Felastic.png",[177],"reported_by",{"slug":179,"title":180,"body":181,"framework_refs":182,"framework_notes":190},"stolen-credentials-exploited-in-under-8-minutes-as-ai-tools-and-signed-software-weaponized","Stolen Credentials Exploited in Under 8 Minutes as AI Tools and Signed Software Weaponized","Attackers are demonstrating that once credentials are stolen, the window for defenders to respond is critically short — averaging just eight minutes before unauthorized access occurs. The abuse of trusted AI coding assistants and digitally signed remote monitoring tools allows attackers to blend in with legitimate activity, bypassing traditional defenses. Users being manipulated into executing malicious commands highlights a persistent gap in security awareness training. This matters because even strong perimeter defenses are rendered ineffective when valid credentials and trusted tools are weaponized together.",[183,184,185,186,187,188,189],"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","CIS Control 14: Security Awareness and Skills Training","MITRE ATT&CK T1566: Phishing","CIS Control 17: Incident Response Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":191,"MITRE ATT&CK T1566: Phishing":192,"NIST SP 800-53 SI-2: Flaw Remediation":193,"CIS Control 17: Incident Response Management":194,"CIS Control 14: Security Awareness and Skills Training":195,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":196,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":197},"NIS2 mandates incident handling capabilities and access control measures that organizations must have in place — both directly relevant when attackers exploit credentials to access systems within minutes.","Tricking users into executing malicious commands through AI coding assistants mirrors phishing-based initial access techniques, making user deception training and endpoint controls directly applicable.","The abuse of trusted signed tools and AI platforms requires continuous monitoring of the software supply chain and rapid remediation of any misuse vectors identified in those trusted applications.","An 8-minute attacker dwell time demands pre-built, automated incident response playbooks that can trigger credential revocation and session termination faster than manual processes allow.","Users being tricked into executing malicious commands via AI assistants underscores the need for regular, targeted training on social engineering and safe use of AI coding tools.","Controlling which remote monitoring tools and AI assistants are authorized in the environment reduces the attack surface created by trusted-but-abused signed applications.","Enforcing MFA and strong identity verification directly addresses attackers leveraging stolen credentials, ensuring possession of a password alone is not sufficient to gain access."]