Elastic report finds attackers exploit trusted AI tools to execute commands
ESTC•Elastic’s cybersecurity report found attackers used trusted AI and IT tools to execute commands and maintain access. Across 27 confirmed malware cases, stolen credentials were used within eight minutes on average, and ClickFix lures initiated 12 cases.
1. Report findings
Elastic’s report, based on intrusions and research from April through September 2026, found attackers executed commands through Claude Code on Windows and ChatGPT desktop on macOS. Researchers confirmed 23 cases involving legitimate remote IT software used to maintain access, most often ScreenConnect. The report recommends monitoring trusted software behavior and coordinating detection across cloud, endpoint and identity data.
