James

Attackers are using legitimate AI coding assistants to execute malicious commands on compromised endpoints. In two confirmed intrusions, Elastic Threat Command observed adversaries operating cyber attacks through Claude Code on Windows and the ChatGPT desktop app on macOS. Both involved trusted applications being used to carry out malicious activity. @_xDeJesus principal security research engineer at Elastic Threat Command, walks through the findings and what security teams should be looking for: go.es.io/47ZcxMM The findings highlight a detection challenge: These applications are signed and authorized to execute commands, making it difficult to distinguish legitimate activity from attacker behavior. The speed of these attacks is another concern. Elastic researchers observed an average of just eight minutes between ClickFix/infostealer infection and attackers logging in with stolen credentials. In the latest threats, etc quarterly report, Elastic Threat Command documents these intrusions and examines the implications for endpoint visibility, behavioral detection, and threat hunting. Full report: go.es.io/4sO5G2k

wp2shell PoCs went public within hours of disclosure, and we are seeing active exploitation. Pre-auth RCE in WordPress Core. No plugins required. CVE-2026-63030 and CVE-2026-60137. We ran the Icex0 PoC end-to-end with Elastic Defend. On the host, every run ends the same way. The web server writes PHP under wp-content/plugins/, then spawns a shell. 4 rules caught it: - Payload Execution by Web Server: EDR, kills the shell on launch - PHP File Creation in WordPress Plugin Directory: catches the drop before execution - Suspicious Command Execution via Web Server: flags discovery commands from the web parent - Unusual Command Execution via Web Server: alerts on command lines the host has never run The PoC self-cleans after running. A missing plugin folder doesn't mean a clean host. Patch to 7.0.2 or 6.9.5. Hunt the IOCs while tooling is still stock. Full rule walkthrough, process lineage, and Attack Discovery correlation: go.es.io/4wW8NpB

7 trojanized repos targeting developers. Zero detections across every AV vendor. Elastic Security Labs is tracking a new Contagious Interview campaign (REF9403) where DPRK-aligned actors distribute fake coding challenges through Slack job postings. The repos masquerade as real Next.js e-commerce projects. The code was copied from a legitimate template called GoCart. The difference is steganography. Base64 payload fragments are hidden inside HTML comments in SVG flag images. A script reassembles them alphabetically, decodes with a custom function, and runs on server start. What deploys: - Credential stealer targeting 25 crypto wallet extensions plus browser login data - File stealer scanning for .env, .pem, .ssh, .aws, documents, images, shell history, and source code - Socket. IO RAT providing real-time interactive shell access - Clipboard stealer polling every 500ms, plus a Windows dropper downloading 3 disguised executables from the C2 Full analysis from Elastic Security Labs by @danielstepanic : go.es.io/4fqEhgp

We tracked a new activity cluster targeting Mexican banking customers. Elastic Security Labs discovered REF6045, an operator-assisted banking fraud campaign targeting customers of Mexican banks, fintechs, and cryptocurrency platforms through ClickFix fake-CAPTCHA lures. The operation exhibits a reliance on AI-generated code and suffers from significant operational security (OPSEC) failures that exposed their infrastructure and their toolkit. The toolkit gives operators a full fraud workflow from: •Vishing overlay: lock the screen behind a fake bank warning •Browser redirect: paste a phishing URL via automated keystrokes •Clipboard swap: replace CLABE or card numbers mid-transfer •Remote access: install Remote Utilities for hands-on takeover Research by @k33b0i and @soolidsnakee. Full analysis from Elastic Security Labs: go.es.io/4eP6VZF

We have identified a novel social engineering campaign abusing Obsidian, the popular note taking app, to deliver a previously undocumented RAT #PHANTOMPULSE and it’s loader #PHANTOMPULL targeting individuals in finance and crypto. The attack never exploits a vulnerability. It abuses Obsidian's own plugin ecosystem to execute code the moment a victim opens a shared vault. Full analysis: go.es.io/4cld0dB

ElasticSecurityLabs detects the Axios npm supply chain attack across Linux, Windows & macOS. Our behavioral detections caught it without relying on static indicators. Full malware analysis dropping soon: go.es.io/488UwvJ

APT confirmation used to take hours. Now it takes 4 minutes. Attack Discovery correlates alerts into a single narrative. A workflow triggers the agent. The agent: • Looks up the hash on VirusTotal • Runs ES|QL queries across your logs • Finds the on-call analyst • Creates a case • Opens a Slack incident channel All before you read the threat intel report.