Credential-Theft and Remote Access Abuse: Infostealers, ClickFix, ScreenConnect RMM Abuse and AiTM Phishing (Elastic Security Labs, Nov 2026)

Key facts

Detection coverage

As of 2026-11-09, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5526 across Splunk SPL, Microsoft KQL and Sigma, covering 22 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: SILENTCONNECT VBScript Lure to In-Memory C# Compile — Exploitation

Behaviour-first detection of the SILENTCONNECT initial execution chain documented by Elastic (TL-2026-5526): an E-INVITE.vbs or 2025Trans.vbs VBScript lure run by wscript/cscript that spawns PowerShell compiling C# in memory with Add-Type (FileR.txt), plus known loader hashes. This chain precedes silent ScreenConnect installation.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1059.005, T1059.001, T1027, T1204.004, T1566.002
• Data sources: sysmon, windows_security
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
```TL-2026-5526 SILENTCONNECT: E-INVITE.vbs lure runs PowerShell that compiles C# in memory via Add-Type (FileR.txt staged in Windows Temp)```
| eval img=lower(Image), parent=lower(coalesce(ParentImage,"")), cmd=lower(coalesce(CommandLine,""))
| eval ps_chain=if((like(img,"%powershell.exe") OR like(img,"%pwsh.exe")) AND (like(parent,"%wscript.exe") OR like(parent,"%cscript.exe")) AND (like(cmd,"%add-type%") OR like(cmd,"%filer.txt%") OR like(cmd,"%-encodedcommand%")),1,0)
| eval vbs_lure=if(like(img,"%wscript.exe") AND (like(cmd,"%e-invite.vbs%") OR like(cmd,"%2025trans.vbs%") OR like(cmd,"%download_invitee%")),1,0)
| eval hash_hit=if(match(lower(coalesce(Hashes,"")),"281226ca0203537fa422b17102047dac314bc0c466ec71b2e6350d75f968f2a3|adc1cf894cd35a7d7176ac5dab005bea55516bc9998d0c96223b6c0004723c37|8bab731ac2f7d015b81c2002f518fff06ea751a34a711907e80e98cf70b557db"),1,0)
| where ps_chain=1 OR vbs_lure=1 OR hash_hit=1
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines values(ParentImage) as parents sum(ps_chain) as ps_chain sum(vbs_lure) as vbs_lure sum(hash_hit) as hash_hit by host User Image
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where (FileName in~ ('powershell.exe','pwsh.exe') and InitiatingProcessFileName in~ ('wscript.exe','cscript.exe') and ProcessCommandLine has_any ('Add-Type','FileR.txt','-EncodedCommand'))
    or (FileName =~ 'wscript.exe' and ProcessCommandLine has_any ('E-INVITE.vbs','2025Trans.vbs','download_invitee'))
    or SHA256 in~ ('281226ca0203537fa422b17102047dac314bc0c466ec71b2e6350d75f968f2a3','adc1cf894cd35a7d7176ac5dab005bea55516bc9998d0c96223b6c0004723c37','8bab731ac2f7d015b81c2002f518fff06ea751a34a711907e80e98cf70b557db')
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| order by Timestamp desc

Sigma

title: SILENTCONNECT VBScript Lure Launching In-Memory C# Compilation PowerShell
id: 3f1b7c2e-5a41-4d0e-9b6a-1c2d3e4f5a01
status: experimental
description: Detects the SILENTCONNECT (TL-2026-5526) initial chain, a Turnstile-gated E-INVITE.vbs or 2025Trans.vbs lure run by wscript or cscript that starts PowerShell compiling C# in memory with Add-Type (FileR.txt), prior to silent ScreenConnect installation.
references:
    - https://www.elastic.co/security-labs/reports/threats-etc-report-november-2026-trouble-with-trust
    - https://www.elastic.co/security-labs/threat-command/silentconnect-delivers-screenconnect
author: Threadlinqs Team
date: 2026/11/09
tags:
    - attack.execution
    - attack.t1059.005
    - attack.t1059.001
    - attack.defense-evasion
    - attack.t1027
    - attack.initial-access
    - attack.t1566.002
    - attack.t1204.004
logsource:
    category: process_creation
    product: windows
detection:
    selection_ps:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
        ParentImage|endswith:
            - '\wscript.exe'
            - '\cscript.exe'
        CommandLine|contains:
            - 'Add-Type'
            - 'FileR.txt'
            - '-EncodedCommand'
    selection_vbs:
        Image|endswith: '\wscript.exe'
        CommandLine|contains:
            - 'E-INVITE.vbs'
            - '2025Trans.vbs'
            - 'download_invitee'
    selection_hash:
        Hashes|contains:
            - 'SHA256=281226ca0203537fa422b17102047dac314bc0c466ec71b2e6350d75f968f2a3'
            - 'SHA256=adc1cf894cd35a7d7176ac5dab005bea55516bc9998d0c96223b6c0004723c37'
            - 'SHA256=8bab731ac2f7d015b81c2002f518fff06ea751a34a711907e80e98cf70b557db'
    condition: 1 of selection_*
falsepositives:
    - Administrators running signed VBScript logon or inventory scripts that call Add-Type
    - Legacy line-of-business VBScript that shells out to PowerShell
level: high

Known false positives:

• Administrator VBScript that calls PowerShell Add-Type for inventory or logon tasks
• Software packaging or deployment scripts launched through wscript

Tuning notes: Exclude signed internal script paths and known admin hosts. If PowerShell Script Block Logging (4104) is available, add a FileR.txt Add-Type content check. Tighten by requiring the VBS to originate from Downloads or a browser parent.

• 🔒 ClickFix Paste-and-Run Execution — Exploitation · unlock with TL Creds
• 🔒 Entra ID ROPC, Device-Code, PRT and Device Registration Abuse — Post-Exploitation · unlock with TL Creds
• 🔒 AI Coding Agent Shell Spawn and SOCKS5 Tunnel (claude.exe, [indicator]) — C2 · unlock with TL Creds
• 🔒 Remote MSI Install via Msiexec URL (ClickFix Delivery) — Exploitation · unlock with TL Creds
• 🔒 macOS Keychain Dump and AppleScript Password Harvest — Post-Exploitation · unlock with TL Creds
• 🔒 macOS Agent Permission Bypass, Cloudflare Quick Tunnel and LaunchAgent — C2 · unlock with TL Creds
• 🔒 Silent RMM Install, Defender Exclusion and UAC Bypass — Post-Exploitation · unlock with TL Creds
• 🔒 ScreenConnect C2 Beaconing and SILENTCONNECT Infrastructure — C2 · unlock with TL Creds

Indicators of compromise

As of 2026-11-09, Threadlinqs Intelligence tracks 22 indicators of compromise for TL-2026-5526.

Sample indicators (3 of 22)

• IP address: 86.38.225[.]59
• Domain: bumptobabeco[.]top
• File hash: 281226ca0203537fa422b17102047dac314bc0c466ec71b2e6350d75f968f2a3

Defanged, TLP:CLEAR. Full set of 22 indicators: unlock with TL Creds.

Technical analysis

The report also documents Tycoon 2FA AiTM phishing, device-code phishing, and post-access abuse of AI coding/assistant applications to run commands.

Elastic Security Threat Command published the November 2026 'threats, etc' report (theme: 'Trouble with Trust') on 4 November 2026, covering confirmed customer intrusions and first-party research between 4 April and 8 September 2026. Its core finding is that attackers increasingly operate inside software defenders were told to trust: signed RMM agents, browser updaters, vendor installers, Apple scripting utilities, Microsoft first-party clients and AI coding agents. Elastic notes counts come from its own telemetry, may overlap, and should not be read as global prevalence.

Infostealer activity: across 27 confirmed infostealer findings, the average time from infection to attacker login with the stolen credentials was about 8 minutes. 12 of 27 (44%) began with a ClickFix-style paste-and-run lure; the others came from 8 trojanised installers/updaters, 5 malicious npm projects and 2 newly registered domains. 19 findings were Windows and 8 macOS. In a healthcare case, a paste-and-run lure led to remote MSI delivery with DLL sideloading roughly 16 seconds after the user followed the lure. A macOS education-sector case used AppleScript to prompt for the local password, validate it with dscl, harvest encryption keys for 13+ Chromium-based browsers and dump the keychain. Infostealer families are not named in the coverage reviewed.

RMM abuse: 23 confirmed RMM findings between 15 June and 12 August 2026, ScreenConnect named most often. Related Elastic research on SILENTCONNECT documents a Cloudflare Turnstile 'digital invitation' lure delivering a VBScript that compiles C# in memory, bypasses UAC, adds a Defender exclusion for .exe files and silently installs ScreenConnect, which beacons on TCP 8041; alternate chains use a fake DocuSign page (preconfigured ScreenConnect MSI) and a fake Teams page (Syncro agent). In the TOLLBOOTH case a Chinese-speaking actor tracked as REF3927 entered a misconfigured IIS server via leaked ASP.NET machine keys and uploaded GotoHTTP after account-creation attempts failed. Healthcare cases included a trojanised GalacticAgent build harvesting browser credentials and card data. Elastic: RMM abuse is an inventory problem before it is a detection problem.

Identity attacks: Tycoon 2FA (tracked by Microsoft as Storm-1747), an AiTM phishing kit, remained in use after Microsoft and Europol seized 330 domains in March; Elastic observed a primary refresh token (PRT) issued within minutes of credential entry. A 1 June Kali365 device-code phishing case ended with an attacker-registered device and a PRT. On 9 July a compromised university account reached Azure Resource Manager from a known-malicious anonymised IP using ROPC, bypassing Conditional Access. Legacy authentication without a second factor was also abused.

AI application abuse (post-access misuse, not a vulnerability in the providers): on 5 August 2026 an operator drove Claude Code through its VS Code extension over RDP to stage tooling and reach a self-hosted GitLab via a SOCKS5 tunnel script (minsk-tunnel.ps1); detection keyed on PowerShell children of claude.exe and repeated curl calls via port 1080. Days later the ChatGPT desktop app on macOS was used as a command proxy to read an internal infrastructure document and dump the login keychain. Two further macOS intrusions began with permission-bypass flags (e.g. --allow-dangerously-skip-permissions), set up a Cloudflare quick tunnel and a LaunchAgent for persistence, and harvested keychains.

Elastic guidance: judge tools by behaviour not approval status; treat paste-and-run as an execution primitive; maintain an inventory of approved RMM tools and treat unexpected ones as high-confidence alerts; after a stealer infection rotate cookies/session tokens and treat exposed vaults/keychains as fully compromised; disable legacy authentication; alert on unmanaged device registration and PRT issuance; do not treat first-party Microsoft app IDs as a trust signal; use UEBA and cross-domain correlation. No named actor is attributed to the overall campaign; the report aggregates many unrelated intrusions.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027 Obfuscated Files or Information; T1574.001 DLL

Execution

T1059.001 PowerShell; T1059.002 AppleScript; T1059.005 Visual Basic; T1204.004 Malicious Copy and Paste

Persistence

T1098.005 Device Registration; T1543.001 Launch Agent

Initial Access

T1190 Exploit Public-Facing Application; T1566.002 Spearphishing Link

Command and Control

T1219.002 Remote Desktop Software; T1572 Protocol Tunneling

Credential Access

T1528 Steal Application Access Token; T1539 Steal Web Session Cookie; T1555.001 Keychain; T1555.003 Credentials from Web Browsers; T1557 Adversary-in-the-Middle

Privilege Escalation

T1548.002 Bypass User Account Control

lateral-movement

T1550.004 Web Session Cookie

defense-impairment

T1685 Disable or Modify Tools

Remediation

Immediate actions

• After any infostealer infection, revoke and rotate browser cookies, session tokens and saved credentials; treat exposed KeePass databases or macOS keychains as fully compromised
• Inventory approved RMM tools (ScreenConnect, Syncro, GotoHTTP, etc.) and alert on any unapproved RMM install or beacon, e.g. ScreenConnect client traffic on TCP 8041
• Alert on unmanaged device registrations and primary refresh token (PRT) issuance in Entra ID
• Hunt for PowerShell/shell children of AI coding agents (e.g. claude.exe) and permission-bypass flags such as --allow-dangerously-skip-permissions

Workarounds

• Use phishing-resistant MFA (FIDO2/passkeys) to resist AiTM kits such as Tycoon 2FA
• Application allow-listing combined with behavioural monitoring of approved tools

Longer-term hardening

• Disable legacy authentication and block ROPC flows via Conditional Access
• Restrict or block device-code flow for users who do not need it
• Deploy UEBA and cross-domain correlation to baseline activity inside trusted software
• Treat paste-and-run (Win+R / terminal paste) as an execution primitive; restrict Run dialog and monitor clipboard-to-shell chains
• Give each AI agent a unique identity and owner, and limit its credentials and network access

Affected and fixed versions

• ConnectWise — ScreenConnect (abused as RMM)
• Microsoft — Entra ID / Microsoft 365 (AiTM, device-code, ROPC, PRT abuse)
• Microsoft — Windows (ClickFix, DLL sideloading)
• Apple — macOS (AppleScript infostealers, keychain theft)
• Anthropic / OpenAI / Anysphere — AI coding assistants and desktop apps (Claude Code, ChatGPT desktop, Cursor) misused post-access; no vulnerability reported

Timeline

• 2025-03-01 Elastic believes SILENTCONNECT loader activity (ScreenConnect delivery) began around March 2025 and stayed under the radar since.
• 2026-03-19 Elastic Security Labs publishes SILENTCONNECT research detailing the VBScript/PowerShell/C# chain delivering ScreenConnect.
• 2026-04-04 Start of the period (4 April to 8 September 2026) covered by Elastic's confirmed-intrusion data.
• 2026-06-01 Kali365 device-code phishing case ends with an attacker-registered device and a primary refresh token.
• 2026-06-15 Start of the 15 June to 12 August window in which Elastic confirmed 23 RMM-abuse findings.
• 2026-07-09 Compromised university account reaches Azure Resource Manager from a malicious anonymised IP using ROPC, bypassing Conditional Access.
• 2026-08-05 Operator drives Claude Code via its VS Code extension over RDP on Windows to stage tooling and tunnel to a self-hosted GitLab (locked-ioc-12).
• 2026-08-10 ChatGPT desktop app on macOS used (about five days after the Claude Code case) to read an internal infrastructure document and dump the login keychain.
• 2026-09-08 End of the data window covered by the Elastic threats, etc report.
• 2026-11-04 Elastic Security Threat Command publishes the first quarterly threats, etc report (Trouble with Trust): 8-minute average login time, 12 of 27 ClickFix entries, 23 RMM findings.
• 2026-11-09 Help Net Security and ITWire publish coverage of the Elastic report.

Sources cited

• Elastic Security Labs: Threats etc. Report, November 2026: Trouble with Trust elastic.co · Research · 2026-11-04
• Elastic Security Labs: SILENTCONNECT delivers ScreenConnect elastic.co · Research · 2026-03-19
• Elastic Security Threat Command - threats, etc report download elastic.co · Vendor report · 2026-11-04
• An average of 8 minutes is all hackers need to log in with stolen credentials Help Net Security · News · 2026-11-09
• Elastic threat report: stolen logins used within eight minutes as attackers turn trusted AI agents and IT tools on their owners (ITWire) itwire.com · News · 2026-11-09

More in threat intel

• Operation Snowball: Autonomous AI-Driven Intrusion Campaign Exploiting Cisco BroadWorks XSP (CVE-2026-20320) Against European Telecom
• FATF Targets Global Scam Compounds: Trafficked-Labor Fraud Operations Backed by Crypto, Instant Payments and AI-Enabled Content
• NVIDIA Board Opens Independent Investigation into Reported Foreign Intelligence Targeting of CEO Jensen Huang
• LLM-Assisted Reverse Engineering of Palo Alto Cortex XDR Enables Targeted EDR Evasion (SpecterOps research, tl;dr sec #338)
• Top 10 Critical Threat Actors to Watch in 2026: Akira, DragonForce, Qilin, LockBit, Scattered Spider, Cl0p, Lazarus, Volt Typhoon, APT29, OilRig (CVE-2024-40766, CVE-2025-61882, CVE-2023-34362, CVE-2024-39717, CVE-2024-30088)

Further reading

• OpenClaw AI Agent Threat Landscape: 8 Attacks
• OpenCode AI Coding Agent: 8 Attack Vectors