8 Minutes: How Hackers Quickly Access Stolen Credentials

An average of eight minutes is required for cybercriminals to gain unauthorized access using stolen credentials, according to findings from Elastic Security Threat Command.

Threat Actors Exploit Stolen Credentials

The research highlights how threat actors exploit compromised login details to infiltrate systems, with malicious activity often occurring within minutes of initial compromise across 27 confirmed infostealer incidents.

Use of AI Tools and Remote Monitoring Software

The report also details the use of artificial intelligence tools and digitally signed remote monitoring software to sustain persistence and evade detection. Researchers identified instances where coding assistants such as Claude Code and the ChatGPT desktop application were leveraged to execute system commands.

Examples of Tool Misuse

These tools, designed for legitimate development tasks, can interact with files, credentials, and other applications, providing attackers with a pathway to manipulate systems. In one case, a Windows-based intrusion involved a remote connection to a machine where the Claude Code extension was used to deploy tools and establish a covert link to an external server. On macOS, the ChatGPT desktop application was exploited to access an internal infrastructure document and retrieve stored passwords.

Incidents and Entry Points

The report clarifies that these incidents do not indicate inherent vulnerabilities in the applications themselves but rather their misuse after initial compromise. Stolen credentials were utilized almost immediately following infiltration.

Infostealer Malware Targets Trusted Applications

Infostealer malware targeted trusted applications, including signed remote monitoring agents, browser updaters, vendor installers, and Apple’s scripting utilities. ClickFix-style verification pages served as the primary entry point in 12 cases, tricking users into executing malicious commands disguised as routine verification steps.

Exploitation of Remote Monitoring Tools

Remote monitoring and management tools, which enable IT staff to control devices, were also exploited in 23 confirmed cases. Phishing pages and malicious script archives facilitated installations, with ScreenConnect being the most frequently cited tool.

Adversary-in-the-Middle (AiTM) Phishing Kits

Threat actors also exploited trusted authentication services to bypass security measures. Adversary-in-the-middle (AiTM) phishing kits intercepted login sessions by acting as a relay between victims and legitimate login pages. When users entered credentials and completed multifactor authentication, attackers captured the resulting session tokens.

Recommendations for Organizations

The report emphasizes that traditional signature-based defenses are insufficient against these tactics. Instead, organizations must adopt user and entity behavior analytics (UEBA) to detect anomalies, combined with cross-domain visibility and active correlation across security systems.

“The findings underscore the evolving strategies of cybercriminals, who increasingly exploit legitimate tools and processes to avoid detection. As threat actors refine their methods, enterprises must prioritize advanced monitoring and adaptive security frameworks to mitigate risks associated with credential theft and lateral movement.”