# Credential-Theft and Remote Access Abuse: Infostealers, ClickFix, ScreenConnect RMM Abuse and AiTM Phishing (Elastic Security Labs, Nov 2026)

> Elastic Security Threat Command's first quarterly 'threats, etc' report (Nov 2026) found attackers logged in with stolen credentials an average of 8 minutes after infostealer/ClickFix infection across 27 confirmed infostealer cases, with 12 beginning with ClickFix lures and 23 confirmed RMM-abuse findings (ScreenConnect most common). The report also documents Tycoon 2FA AiTM phishing, device-code phishing, and post-access abuse of AI coding/assistant applications to run commands.

- **Published:** 2026-11-09T05:44:07Z
- **Last reviewed:** 2026-11-09T05:44:07Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5526
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5526.png
- **ID:** TL-2026-5526
- **Severity:** HIGH
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 22 (3 shown free below)

## Description

Elastic Security Threat Command published the November 2026 'threats, etc' report (theme: 'Trouble with Trust') on 4 November 2026, covering confirmed customer intrusions and first-party research between 4 April and 8 September 2026. Its core finding is that attackers increasingly operate inside software defenders were told to trust: signed RMM agents, browser updaters, vendor installers, Apple scripting utilities, Microsoft first-party clients and AI coding agents. Elastic notes counts come from its own telemetry, may overlap, and should not be read as global prevalence.

Infostealer activity: across 27 confirmed infostealer findings, the average time from infection to attacker login with the stolen credentials was about 8 minutes. 12 of 27 (44%) began with a ClickFix-style paste-and-run lure; the others came from 8 trojanised installers/updaters, 5 malicious npm projects and 2 newly registered domains. 19 findings were Windows and 8 macOS. In a healthcare case, a paste-and-run lure led to remote MSI delivery with DLL sideloading roughly 16 seconds after the user followed the lure. A macOS education-sector case used AppleScript to prompt for the local password, validate it with dscl, harvest encryption keys for 13+ Chromium-based browsers and dump the keychain. Infostealer families are not named in the coverage reviewed.

RMM abuse: 23 confirmed RMM findings between 15 June and 12 August 2026, ScreenConnect named most often. Related Elastic research on SILENTCONNECT documents a Cloudflare Turnstile 'digital invitation' lure delivering a VBScript that compiles C# in memory, bypasses UAC, adds a Defender exclusion for .exe files and silently installs ScreenConnect, which beacons on TCP 8041; alternate chains use a fake DocuSign page (preconfigured ScreenConnect MSI) and a fake Teams page (Syncro agent). In the TOLLBOOTH case a Chinese-speaking actor tracked as REF3927 entered a misconfigured IIS server via leaked ASP.NET machine keys and uploaded GotoHTTP after account-creation attempts failed. Healthcare cases included a trojanised GalacticAgent build harvesting browser credentials and card data. Elastic: RMM abuse is an inventory problem before it is a detection problem.

Identity attacks: Tycoon 2FA (tracked by Microsoft as Storm-1747), an AiTM phishing kit, remained in use after Microsoft and Europol seized 330 domains in March; Elastic observed a primary refresh token (PRT) issued within minutes of credential entry. A 1 June Kali365 device-code phishing case ended with an attacker-registered device and a PRT. On 9 July a compromised university account reached Azure Resource Manager from a known-malicious anonymised IP using ROPC, bypassing Conditional Access. Legacy authentication without a second factor was also abused.

AI application abuse (post-access misuse, not a vulnerability in the providers): on 5 August 2026 an operator drove Claude Code through its VS Code extension over RDP to stage tooling and reach a self-hosted GitLab via a SOCKS5 tunnel script (minsk-tunnel.ps1); detection keyed on PowerShell children of claude.exe and repeated curl calls via port 1080. Days later the ChatGPT desktop app on macOS was used as a command proxy to read an internal infrastructure document and dump the login keychain. Two further macOS intrusions began with permission-bypass flags (e.g. --allow-dangerously-skip-permissions), set up a Cloudflare quick tunnel and a LaunchAgent for persistence, and harvested keychains.

Elastic guidance: judge tools by behaviour not approval status; treat paste-and-run as an execution primitive; maintain an inventory of approved RMM tools and treat unexpected ones as high-confidence alerts; after a stealer infection rotate cookies/session tokens and treat exposed vaults/keychains as fully compromised; disable legacy authentication; alert on unmanaged device registration and PRT issuance; do not treat first-party Microsoft app IDs as a trust signal; use UEBA and cross-domain correlation. No named actor is attributed to the overall campaign; the report aggregates many unrelated intrusions.

## MITRE ATT&CK

- T1566.002 Spearphishing Link
- T1190 Exploit Public-Facing Application
- T1204.004 Malicious Copy and Paste
- T1059.001 PowerShell
- T1059.005 Visual Basic
- T1059.002 AppleScript
- T1543.001 Launch Agent
- T1098.005 Device Registration
- T1548.002 Bypass User Account Control
- T1574.001 DLL
- T1685 Disable or Modify Tools
- T1027 Obfuscated Files or Information
- T1550.004 Web Session Cookie
- T1555.001 Keychain
- T1555.003 Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1557 Adversary-in-the-Middle
- T1528 Steal Application Access Token
- T1219.002 Remote Desktop Software
- T1572 Protocol Tunneling

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**SILENTCONNECT VBScript Lure to In-Memory C# Compile — Exploitation** (`TL-2026-5526-SPL-001`)

Behaviour-first detection of the SILENTCONNECT initial execution chain documented by Elastic (TL-2026-5526): an E-INVITE.vbs or 2025Trans.vbs VBScript lure run by wscript/cscript that spawns PowerShell compiling C# in memory with Add-Type (FileR.txt), plus known loader hashes. This chain precedes silent ScreenConnect installation.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1059.005, T1059.001, T1027, T1204.004, T1566.002
- **Data sources:** sysmon, windows_security
- **Severity:** high
- **Confidence:** high

### Splunk SPL

````spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
```TL-2026-5526 SILENTCONNECT: E-INVITE.vbs lure runs PowerShell that compiles C# in memory via Add-Type (FileR.txt staged in Windows Temp)```
| eval img=lower(Image), parent=lower(coalesce(ParentImage,"")), cmd=lower(coalesce(CommandLine,""))
| eval ps_chain=if((like(img,"%powershell.exe") OR like(img,"%pwsh.exe")) AND (like(parent,"%wscript.exe") OR like(parent,"%cscript.exe")) AND (like(cmd,"%add-type%") OR like(cmd,"%filer.txt%") OR like(cmd,"%-encodedcommand%")),1,0)
| eval vbs_lure=if(like(img,"%wscript.exe") AND (like(cmd,"%e-invite.vbs%") OR like(cmd,"%2025trans.vbs%") OR like(cmd,"%download_invitee%")),1,0)
| eval hash_hit=if(match(lower(coalesce(Hashes,"")),"281226ca0203537fa422b17102047dac314bc0c466ec71b2e6350d75f968f2a3|adc1cf894cd35a7d7176ac5dab005bea55516bc9998d0c96223b6c0004723c37|8bab731ac2f7d015b81c2002f518fff06ea751a34a711907e80e98cf70b557db"),1,0)
| where ps_chain=1 OR vbs_lure=1 OR hash_hit=1
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines values(ParentImage) as parents sum(ps_chain) as ps_chain sum(vbs_lure) as vbs_lure sum(hash_hit) as hash_hit by host User Image
| convert ctime(first_seen) ctime(last_seen)
````

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where (FileName in~ ('powershell.exe','pwsh.exe') and InitiatingProcessFileName in~ ('wscript.exe','cscript.exe') and ProcessCommandLine has_any ('Add-Type','FileR.txt','-EncodedCommand'))
    or (FileName =~ 'wscript.exe' and ProcessCommandLine has_any ('E-INVITE.vbs','2025Trans.vbs','download_invitee'))
    or SHA256 in~ ('281226ca0203537fa422b17102047dac314bc0c466ec71b2e6350d75f968f2a3','adc1cf894cd35a7d7176ac5dab005bea55516bc9998d0c96223b6c0004723c37','8bab731ac2f7d015b81c2002f518fff06ea751a34a711907e80e98cf70b557db')
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| order by Timestamp desc
```

### Sigma

```yaml
title: SILENTCONNECT VBScript Lure Launching In-Memory C# Compilation PowerShell
id: 3f1b7c2e-5a41-4d0e-9b6a-1c2d3e4f5a01
status: experimental
description: Detects the SILENTCONNECT (TL-2026-5526) initial chain, a Turnstile-gated E-INVITE.vbs or 2025Trans.vbs lure run by wscript or cscript that starts PowerShell compiling C# in memory with Add-Type (FileR.txt), prior to silent ScreenConnect installation.
references:
    - https://www.elastic.co/security-labs/reports/threats-etc-report-november-2026-trouble-with-trust
    - https://www.elastic.co/security-labs/threat-command/silentconnect-delivers-screenconnect
author: Threadlinqs Team
date: 2026/11/09
tags:
    - attack.execution
    - attack.t1059.005
    - attack.t1059.001
    - attack.defense-evasion
    - attack.t1027
    - attack.initial-access
    - attack.t1566.002
    - attack.t1204.004
logsource:
    category: process_creation
    product: windows
detection:
    selection_ps:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
        ParentImage|endswith:
            - '\wscript.exe'
            - '\cscript.exe'
        CommandLine|contains:
            - 'Add-Type'
            - 'FileR.txt'
            - '-EncodedCommand'
    selection_vbs:
        Image|endswith: '\wscript.exe'
        CommandLine|contains:
            - 'E-INVITE.vbs'
            - '2025Trans.vbs'
            - 'download_invitee'
    selection_hash:
        Hashes|contains:
            - 'SHA256=281226ca0203537fa422b17102047dac314bc0c466ec71b2e6350d75f968f2a3'
            - 'SHA256=adc1cf894cd35a7d7176ac5dab005bea55516bc9998d0c96223b6c0004723c37'
            - 'SHA256=8bab731ac2f7d015b81c2002f518fff06ea751a34a711907e80e98cf70b557db'
    condition: 1 of selection_*
falsepositives:
    - Administrators running signed VBScript logon or inventory scripts that call Add-Type
    - Legacy line-of-business VBScript that shells out to PowerShell
level: high

```

**Known false positives:**

- Administrator VBScript that calls PowerShell Add-Type for inventory or logon tasks
- Software packaging or deployment scripts launched through wscript

**Tuning notes:** Exclude signed internal script paths and known admin hosts. If PowerShell Script Block Logging (4104) is available, add a FileR.txt Add-Type content check. Tighten by requiring the VBS to originate from Downloads or a browser parent.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- ClickFix Paste-and-Run Execution — Exploitation (locked: unlock with TL Creds)
- Entra ID ROPC, Device-Code, PRT and Device Registration Abuse — Post-Exploitation (locked: unlock with TL Creds)
- AI Coding Agent Shell Spawn and SOCKS5 Tunnel (claude.exe, [indicator]) — C2 (locked: unlock with TL Creds)
- Remote MSI Install via Msiexec URL (ClickFix Delivery) — Exploitation (locked: unlock with TL Creds)
- macOS Keychain Dump and AppleScript Password Harvest — Post-Exploitation (locked: unlock with TL Creds)
- macOS Agent Permission Bypass, Cloudflare Quick Tunnel and LaunchAgent — C2 (locked: unlock with TL Creds)
- Silent RMM Install, Defender Exclusion and UAC Bypass — Post-Exploitation (locked: unlock with TL Creds)
- ScreenConnect C2 Beaconing and SILENTCONNECT Infrastructure — C2 (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 22)

Defanged, TLP:CLEAR.

- IP address: `86.38.225[.]59`
- Domain: `bumptobabeco[.]top`
- File hash: `281226ca0203537fa422b17102047dac314bc0c466ec71b2e6350d75f968f2a3`

Full set of 22 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [An average of 8 minutes is all hackers need to log in with stolen credentials](https://www.helpnetsecurity.com/2026/11/09/elastic-businesses-remote-access-attacks-report/)
- [Elastic Security Labs: Threats etc. Report, November 2026: Trouble with Trust](https://www.elastic.co/security-labs/reports/threats-etc-report-november-2026-trouble-with-trust)
- [Elastic threat report: stolen logins used within eight minutes as attackers turn trusted AI agents and IT tools on their owners (ITWire)](https://itwire.com/business-it-news/security/elastic-threat-report-stolen-logins-used-within-eight-minutes-as-attackers-turn-trusted-ai-agents-and-it-tools-on-their-owners)
- [Elastic Security Labs: SILENTCONNECT delivers ScreenConnect](https://www.elastic.co/security-labs/threat-command/silentconnect-delivers-screenconnect)
- [Elastic Security Threat Command - threats, etc report download](https://www.elastic.co/resources/security/report/threat-command-cybersecurity-report)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5526