Elastic: intruders ran whole operations inside signed AI assistants

01What happened

Elastic Security Threat Command published the November 2026 edition of its quarterly threats, etc report on 4 November 2026, drawn from confirmed customer intrusions and first-party research between April and September 2026. Authors Terrance DeJesus, Jason Pappalexis and Andrew Pease report that adversaries are moving away from traditional malware and operating inside signed, legitimate products instead. One AI agent-driven attack produced roughly 17,600 reconstructed actions compressed into four days.

02How it works

Trust is the payload. Because remote monitoring agents, AI coding assistants and Microsoft first-party clients are signed and already on the approved list, their execution does not trip controls that identify software rather than behavior, and attackers use them for persistent interactive access on contested endpoints. Elastic also describes victim consent as a repeatable route in, with adversary-in-the-middle phishing kits and gaps in legacy authentication carrying attackers past multifactor authentication and into cloud and SaaS tenants.

03Who is affected

Organizations that approve AI assistants and remote management software are in scope. Elastic counted 23 confirmed remote monitoring and management abuse findings this quarter, naming ScreenConnect most often, and reports that in one healthcare case the path from a paste-and-run lure to installer delivery with DLL sideloading took roughly 16 seconds.

04What to do

Baseline normal activity with user and entity behavior analytics, and hunt for abuse of trust relationships instead of relying on signatures to catch signed software. Elastic recommends monitoring low-level behaviors such as memory tampering and proxy tunneling regardless of which application starts them, correlating activity across cloud, endpoint and identity, and automating alert triage to keep pace with attack speed.

Questions people ask

Does Elastic name which AI assistants the attackers used?

Elastic's published summary of the November 2026 threats, etc report names no specific AI product. The blog post describes the category as signed AI coding assistants, alongside remote monitoring agents and Microsoft first-party clients, and points readers to the full report for technical breakdowns and attacker timelines. ScreenConnect is the only product named in the summary, and that is for remote management abuse.

How fast were the intrusions Elastic observed?

Speed is a central finding of the report. Elastic measured about 16 seconds in one healthcare case, from a paste-and-run lure to installer delivery with DLL sideloading, and about eight minutes on average in some cases between an infostealer infection and the attacker logging in with the same credentials. One AI agent-driven attack compressed roughly 17,600 reconstructed actions into four days.

Why does signature-based detection miss this activity?

Signatures identify software, not behavior, so they do not fire when an approved and signed application is the thing being misused. Elastic argues defenders should watch system-level outcomes such as memory tampering and proxy tunneling regardless of which application initiates them, baseline normal activity with behavior analytics, and accept that the resulting alert volume needs automated triage.

Sources 2 links, all fetched

1. 1elastic.coElastic Security Labs
2. 2elastic.coFull Report