# Elastic: intruders ran whole operations inside signed AI assistants

> Elastic's November 2026 threats, etc report finds attackers abusing the trust placed in approved AI and IT tools.

- **Severity:** Info: Research, tools, evals or lab claims with no direct exposure. Context, not an alert.
- **Category:** Incident, Research
- **Published by:** Elastic Security Labs
- **Disclosed:** 2026-11-04
- **Affects:** AI coding assistants, ScreenConnect, Microsoft first-party clients
- **Research by:** Terrance DeJesus, Jason Pappalexis, Andrew Pease
- **Primary source:** https://www.elastic.co/security-labs/reports/threats-etc-report-november-2026-trouble-with-trust
- **Page:** https://theinjection.dev/items/elastic-threats-etc-trusted-ai-tools/

Elastic reports that attackers ran complete intrusions inside signed AI coding assistants, remote monitoring agents and Microsoft first-party clients, using approved software for persistent interactive access instead of malware.

## What happened

Elastic Security Threat Command published the November 2026 edition of its quarterly threats, etc report on 4 November 2026, drawn from confirmed customer intrusions and first-party research between April and September 2026. Authors Terrance DeJesus, Jason Pappalexis and Andrew Pease report that adversaries are moving away from traditional malware and operating inside signed, legitimate products instead. One AI agent-driven attack produced roughly 17,600 reconstructed actions compressed into four days.

## How it works

Trust is the payload. Because remote monitoring agents, AI coding assistants and Microsoft first-party clients are signed and already on the approved list, their execution does not trip controls that identify software rather than behavior, and attackers use them for persistent interactive access on contested endpoints. Elastic also describes victim consent as a repeatable route in, with adversary-in-the-middle phishing kits and gaps in legacy authentication carrying attackers past multifactor authentication and into cloud and SaaS tenants.

## Who is affected

Organizations that approve AI assistants and remote management software are in scope. Elastic counted 23 confirmed remote monitoring and management abuse findings this quarter, naming ScreenConnect most often, and reports that in one healthcare case the path from a paste-and-run lure to installer delivery with DLL sideloading took roughly 16 seconds.

## What to do

Baseline normal activity with user and entity behavior analytics, and hunt for abuse of trust relationships instead of relying on signatures to catch signed software. Elastic recommends monitoring low-level behaviors such as memory tampering and proxy tunneling regardless of which application starts them, correlating activity across cloud, endpoint and identity, and automating alert triage to keep pace with attack speed.

## Quick facts

- **Reporting period:** April to September 2026
- **Published:** 4 November 2026
- **RMM abuse findings:** 23 confirmed, ScreenConnect named most often
- **AI agent-driven attack:** About 17,600 reconstructed actions in four days
- **Infostealer to login:** About eight minutes on average in some cases
- **Fastest chain observed:** About 16 seconds from paste-and-run lure to DLL sideloading

## Questions

### Does Elastic name which AI assistants the attackers used?

Elastic's published summary of the November 2026 threats, etc report names no specific AI product. The blog post describes the category as signed AI coding assistants, alongside remote monitoring agents and Microsoft first-party clients, and points readers to the full report for technical breakdowns and attacker timelines. ScreenConnect is the only product named in the summary, and that is for remote management abuse.

### How fast were the intrusions Elastic observed?

Speed is a central finding of the report. Elastic measured about 16 seconds in one healthcare case, from a paste-and-run lure to installer delivery with DLL sideloading, and about eight minutes on average in some cases between an infostealer infection and the attacker logging in with the same credentials. One AI agent-driven attack compressed roughly 17,600 reconstructed actions into four days.

### Why does signature-based detection miss this activity?

Signatures identify software, not behavior, so they do not fire when an approved and signed application is the thing being misused. Elastic argues defenders should watch system-level outcomes such as memory tampering and proxy tunneling regardless of which application initiates them, baseline normal activity with behavior analytics, and accept that the resulting alert volume needs automated triage.

## Sources

1. [Elastic Security Labs](https://www.elastic.co/security-labs/reports/threats-etc-report-november-2026-trouble-with-trust)
2. [Full Report](https://www.elastic.co/resources/security/report/threat-command-cybersecurity-report)