When trust becomes the payload: Inside the threats, etc quarterly report

Summary

Elastic Security Threat Command's quarterly threats report, drawn from confirmed customer intrusions and first-party research between April and September 2026, finds attackers abusing trusted software rather than deploying traditional malware. Intrusions use signed legitimate products, including remote monitoring and management agents (ScreenConnect was named most often across 23 confirmed RMM abuse findings), AI coding assistants and Microsoft first-party clients. The report also describes AiTM phishing kits and legacy authentication gaps that bypass MFA, with the time from infostealer infection to login as short as eight minutes.

Related items

• InfoRadio With No Radar: Why Agent Runtime Security Fails Without the Layers Beneath ItSame vendor · The Hacker News
• InfoMicrosoft named a Leader in the 2026 Gartner® Magic Quadrant™ for AI Agent Management Platforms  Same vendor · Microsoft Security Blog
• InfoCrowdStrike Advances AI Security and Safety from Endpoint to CloudSame vendor · CrowdStrike Blog
• InfoIntroducing AI Kill Switch: Taking Control When AI Agents Go RogueSame vendor · CrowdStrike Blog
• InfoAgentic Development Security: How to Secure Code Your Agents Write | Endor LabsSame vendor · Endor Labs Blog