Infostealer Attacks: Stolen Credentials Used an Average of 8 Minutes After Infection, What Elastic Confirmed and What to Do This Week

Elastic's security team says attackers logged in with stolen credentials an average of eight minutes after an infostealer infection, based on 27 confirmed cases on customer computers. If your plan for a suspected infection is that someone looks at it later that day, the attacker may already be in your email, cloud apps or website admin panel.

What happened: infostealer attacks and the eight-minute figure

Elastic Security Threat Command published its quarterly threats, etc report on Wednesday, November 4, 2026. It covers activity seen between April 4 and September 8, 2026, drawn from Elastic telemetry and the team's own threat hunting.

An infostealer is malware that collects saved passwords, session cookies, keychain contents and payment data, then sends them to an operator. Elastic's central point is that much of this activity now runs inside software people already trust.

What Elastic confirmed

These are Elastic's own observations. We could not find an independent check of them.

What is not known about the eight-minute figure

• How it was calculated. The report calls it an average but gives no range, median or case-by-case data.
• Exactly what it covers. Elastic's press release ties it to the 27 cases. Its Security Labs summary says "in some cases." Its report download page describes cloud accounts breached in under eight minutes.
• How widely it applies. Elastic says its counts are not "a census of global activity," and that several findings can share one host or tenant, so a count of findings is not a count of victims.
• Who was hit. Customer identifiers were removed before analysis.

Elastic also sells security products, so read the numbers as one vendor's view. The practical message still holds: treat a suspected infostealer as a live incident, not a ticket for later.

Why resetting a password is not enough after an infostealer

An infostealer does not only take passwords. Elastic warns that "a contained stealer still means exposed cookies and session tokens." Microsoft describes token theft as replaying tokens issued to a user "even if that user has satisfied multifactor authentication."

The report found similar problems in phishing. Adversary-in-the-middle kits relay the real login and MFA prompt, and Elastic says Tycoon 2FA remains in use after a March 2026 seizure of more than 300 domains. Elastic also confirmed a June 1 device-code case in which a user was sent to Microsoft's own sign-in page, and the attack ended with a registered device and a long-lasting token.

We covered the limits of phone codes in Does MFA Stop Stolen Passwords? and one browser defense in our DBSC explainer.

Signed remote tools and AI apps used as cover

Remote monitoring and management (RMM) software lets an administrator connect, run commands and move files, which is why intruders like it. In Elastic's findings, phishing pages and archive lures led to RMM installs. One campaign, SILENTCONNECT, used a fake digital invitation to install ScreenConnect silently as a Windows service that connected to the attacker's server.

A signature alone proves little. One infostealer chain ran through a tool signed with a revoked certificate, which still passes a basic "is it signed" check.

In the AI cases, an operator on August 5 drove Claude Code through its VS Code extension over a remote desktop connection, staging tools and reaching an outside server through a proxy tunnel. Five days later, commands run through the ChatGPT desktop app read internal documents and dumped a Mac's login keychain.

Elastic does not report a flaw in either product. Its report says references to legitimate software "describe misuse by threat actors after access was obtained." Its account of these cases does not say how the attacker first got in.

Why this matters for a company network or website

One work browser can hold the logins for email, accounting, the hosting panel and the domain registrar. If the gap between theft and login is minutes, a daily review of alerts will not catch the first login. Elastic's own conclusion is that speed puts response times "under pressure that staffing alone will not relieve."

The useful work happens before the incident: know what is allowed on your systems, and decide in advance who can cut access. Backup logins need the same attention, as we explained in our passkey security guide.

What to do this week after stolen credentials: checklist

The settings below are for Microsoft 365 and Entra ID. Elastic names Okta and Google Workspace as targets too, so check their equivalents if you use them.

Infostealer attack questions people are asking

How fast do hackers use stolen passwords?

In Elastic's data, an average of eight minutes after infection. Elastic has not published the range behind that number, so individual cases may be much faster or slower.

What is a ClickFix attack?

A fake verification page walks you into pasting a command into the Windows Run dialog, so you launch the malware yourself. It started 12 of Elastic's 27 infostealer cases and sidesteps file-based email scanning.

Does changing your password stop an infostealer?

Not by itself. Stolen session cookies and tokens may keep working, so revoke sessions and clean the infected device as well.

Does MFA stop infostealers?

Not reliably. A stolen session has already passed MFA, and Elastic also saw sign-ins over flows with no second factor. Keep MFA on, but do not treat it as the whole defense.

Is ScreenConnect unsafe?

Elastic's report is about misuse and says naming a product does not mean it is insecure. The risk is a copy your IT team did not install, or one connecting somewhere unfamiliar.

Were Claude Code and ChatGPT hacked?

Elastic does not say so. It describes attackers using these apps as tools after access was obtained.

The bigger lesson

The eight-minute number may be refined, but the pattern behind it is well documented: attackers use what your business already trusts, from a saved browser session to a signed remote support tool. A list of approved tools, a practiced way to revoke sessions and a named person with authority to act will shorten the time an intruder has.

Want your logins, remote tools and response plan reviewed? See security hardening or request a quote.

Get security alerts by email, with the free checklist, at our security alerts page.

Sources: Elastic threats, etc report; Elastic Security Labs summary; Elastic press release; Elastic report download page; Microsoft token theft playbook; Microsoft: revoke user access; Microsoft: block device code flow; Microsoft: block legacy authentication; Microsoft: security defaults; CISA advisory AA23-025A.