An average of 8 minutes is all hackers need to log in with stolen credentials

Attackers used stolen credentials to log in an average of eight minutes after infection across 27 confirmed infostealer cases, according to a report from Elastic Security Threat Command, with ClickFix-style verification pages the most common entry point in 12 cases. The report also documents attackers misusing AI applications such as Claude Code and the ChatGPT desktop app to run commands after gaining access, and abusing signed remote monitoring tools, named most often as ScreenConnect, to maintain access in 23 cases.