When trust becomes the payload: Inside the threats, etc quarterly report

In the cybersecurity community, we build our defenses on a foundation of trust. We trust an AI coding assistant because it’s on our approved software list or can accomplish a task when prompted. We trust a remote monitoring and management (RMM) tool because IT likely installed it to help end users and it has a trusted signature. We even trust first-party applications to sign in on our behalf because the vendor ships them and our tenants pre-authorize them by default.

But what happens when that foundation is flipped on its head?

In this edition of the threats, etc quarterly report, drawn directly from confirmed customer intrusions and first-party research between April and September 2026, Elastic Security Threat Command observed that the things people were told to trust are now being used against them. Adversaries are no longer just trying to defeat our security mechanisms; they’re actively abusing the inherent trust we place in our enterprise stacks. 

3 ways attackers abused trusted software 

Our report explores how adversaries are weaponizing legitimate tools and workflows. Three takeaways from this reporting window:

Zero malware, three legitimate payloads

Attackers are increasingly shifting away from traditional malware. Intrusions are now using signed, legitimate products, specifically remote monitoring agents, AI coding assistants, and Microsoft first-party clients, to maintain persistent, interactive access on contested endpoints. Out of 23 confirmed RMM abuse findings this quarter, ScreenConnect was the product named most often. Because these tools are inherently trusted, execution happens fast. In one confirmed healthcare finding, the behavior from a paste-and-run lure to Microsoft Software Installer (MSI) delivery with dynamic link library (DLL) sideloading took roughly 16 seconds. 

The speed of AI agent–driven attacks

Threat actors are operating directly through AI applications. In one instance, an AI agent–driven attack resulted in roughly 17,600 reconstructed actions compressed into just four days:

Identity and the consent loophole: 8 minutes to compromise

Victim consent is becoming a repeatable path for attackers to gain trusted access. By deploying Adversary-in-the-Middle (AiTM) phishing kits and exploiting the gray areas of legacy authentication, attackers routinely bypass multifactor authentication (MFA) hurdles and use trusted applications to compromise cloud and software-as-a-service (SaaS) tenants. In some cases, the average time from an infostealer infection to the threat actor logging in via the same credentials is only eight minutes.

What this means for practitioners

When attackers operate inside trusted software or on behalf of trusted users, the defensive answer is rarely just deploying a new signature. Detecting and neutralizing these threats requires user and entity behavior analytics (UEBA) to baseline normal activity, alongside cross-domain visibility and active correlation across your security environment.

Speed and breadth change planning more than they change queries. The window between abusing trust and gaining initial access is shrinking rapidly, putting pressure on response times that can’t be resolved by staffing alone. Because a single attack chain now crosses containers, cloud control planes, legitimate users, and software, discerning benign vs. malicious behavior is less clear than it once was. Balancing detection/prevention with moderate security controls is no longer reliable; practitioners on both sides must consider trust relationships and hunt for abuse.

Why signature-based detection misses signed software abuse

Since traditional signatures can’t stop adversaries hiding inside approved software, defense must shift to system-level behavioral outcomes. Catching unauthorized behaviors, like memory tampering and proxy tunneling, requires monitoring low-level system activity, regardless of which application initiates them.

This broader visibility creates a much higher volume of alerts, meaning that triage must scale alongside it. You need to automate to stay ahead of attack speed. Elastic Workflows solves this by combining Elasticsearch Query Language (ES|QL) telemetry context, deterministic rules, and probabilistic AI reasoning to evaluate and filter benign activity directly in the pipeline. Analysts only see high-fidelity threats, complete with the details that they need to respond to machine-speed attacks.

Why Elastic publishes a quarterly threat report

Adversary tradecraft evolves too fast for annual reports. We shifted to a quarterly cadence to keep pace with AI-assisted offense and the rapid weaponization of trusted software. By publishing four times a year, we aim to equip defenders with the intelligence they need to stay ahead.

That focus also dictates what makes the cut. threats, etc centers on notable tradecraft rather than raw telemetry counts: the what instead of the how many. Raw numbers alone don't reflect real operational risk, whereas understanding the exact mechanics of an intrusion gives practitioners what they need to defend against it.

Read the full November 2026 threats, etc report

Stopping these intrusions requires an understanding of the underlying mechanics, not just high-level summaries. The full report includes complete technical breakdowns, attacker timelines, and actionable guidance for detection teams.

Read Elastic Security’s November 2026 threats, etc report here.

Elastic, Elasticsearch, and associated marks are trademarks, logos, or registered trademarks of elasticsearch B.V. in the United States and other countries. All other company and product names are trademarks, logos, or registered trademarks of their respective owners.