An average of 8 minutes is all hackers need to log in with stolen credentials
Hackers log in using stolen credentials in an average of 8 minutes, abusing AI tools and remote access software.
A report from Elastic Security Threat Command reveals attackers can gain access using stolen credentials in an average of just eight minutes. The research highlights the misuse of AI coding assistants like Claude Code and ChatGPT to execute commands, and the abuse of digitally signed remote monitoring tools to maintain access. Attackers are leveraging these methods to bypass traditional defenses by tricking users into executing malicious commands or by exploiting trusted applications.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Elastic?
Get an email when a new story names Elastic, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAttackers are demonstrating that once credentials are stolen, the window for defenders to respond is critically short — averaging just eight minutes before unauthorized access occurs. The abuse of trusted AI coding assistants and digitally signed remote monitoring tools allows attackers to blend in with legitimate activity, bypassing traditional defenses. Users being manipulated into executing malicious commands highlights a persistent gap in security awareness training. This matters because even strong perimeter defenses are rendered ineffective when valid credentials and trusted tools are weaponized together.
What helps against this
How we list vendors
- Privileged access management (PAM)
Admin accounts stop being one stolen password away from control of everything.
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — infostealer
- mitre_attack — T1059.001
- mitre_attack — T1555
- mitre_attack — T1105
- mitre_attack — T1071.001
- mitre_attack — T1055.012
- mitre_attack — T1539
- mitre_attack — T1553.004
- mitre_attack — T1003