Elastic Security Threat Command said in its November 2026 report that, in some cases, attackers logged in with stolen credentials an average of eight minutes after an infostealer infection. Infostealers are programs that take saved passwords, browser sessions and payment details. Help Net Security tied the eight-minute average to 27 confirmed cases.
Help Net Security said the most common way in was a ClickFix-style page, seen in 12 cases. It tricks people into running a malicious command themselves, so email attachment scanning misses it. Stolen session data can also let attackers use an account without the password. Help Net Security also reported attackers using Claude Code on Windows and the ChatGPT desktop app on macOS. These were misuse after attackers got access, not flaws in the products. The sources do not say how many cases sit behind Elastic's "some cases" wording.
Elastic says the gap between abusing trust and getting in is shrinking, and staffing alone cannot fix that. It points to baselining normal activity so odd behaviour from approved tools stands out. Buyers can ask whether their tools flag that behaviour, and who can act within minutes.