Elastic threats, etc. report, November 2026: signed AI assistants as execution parents, RMM agents as the payload, paste-and-run infostealers and legacy-protocol identity abuse

Elastic Security Threat Command's November 2026 threats, etc. report covers activity it observed between 2026-04-04 and 2026-09-08 and says its counts are observations, not market share or a count of victims (Elastic Security Threat Command, 2026-11-04). Its thread is intrusions run through signed, legitimate products: remote monitoring agents, AI coding assistants and Microsoft first-party clients (Elastic Security Labs, 2026-11-04).

On Windows an operator drove Claude Code through its VS Code extension over RDP to stage tooling and reach a self-hosted GitLab instance through a SOCKS5 proxy tunnel; Elastic's rules fired on PowerShell children of claude.exe and repeated curl.exe calls with --socks5-hostname against port 1080. On macOS the ChatGPT desktop application acted as a shell command proxy for a zsh pipeline that ran security dump-keychain against the login keychain, and in two coding-agent cases a session started with permission-bypass flags stood up a Cloudflare quick tunnel and installed LaunchAgent persistence (Elastic Security Threat Command, 2026-11-04).

Of 23 confirmed RMM abuse findings, ScreenConnect was named most often (Elastic Security Labs, 2026-11-04). In the SILENTCONNECT chain a CAPTCHA page framed as a digital invitation drops a VBS script from Cloudflare r2.dev storage and ends in a silent ScreenConnect install whose client runs as a Windows service and beacons to the attacker's server on TCP 8041. In TOLLBOOTH an actor tracked as REF3927 entered a misconfigured IIS server through ViewState deserialization with publicly leaked ASP.NET machine keys, deployed a Godzilla-forked web shell and, when account creation failed, installed GotoHTTP as fallback access over ports 80 and 443 (Elastic Security Threat Command, 2026-11-04).

A compromised university account reached Azure Resource Manager over the ROPC grant from an anonymized address known to be malicious; every successful attempt returned a token, and Conditional Access was bypassed because ROPC never traverses the surface the policy governs. A Kali365 device-code compromise ended with a registered device and a primary refresh token (Elastic Security Threat Command, 2026-11-04).

Triage: Elastic says the same primitive is often both normal product behavior and confirmed theft, so judge an AI-assistant child process by its outcome (a proxy tunnel, a keychain read), not by the signed parent (Elastic Security Threat Command, 2026-11-04).