Attacker Uses Suspected AI-Generated Power Shell Script to Map Active Directory
Summary: Huntress researchers reported an intrusion in early June 2026 in which an unknown threat actor used pre-compromised credentials to gain RDP access to a domain-joined Windows Server, staged tools in C:\ProgramData\, and ran a suspected AI-generated PowerShell script that mapped Active Directory users, computers, groups, OUs, and trusts. The script, titled "100% Working AD Information Gathering Script - FULLY FIXED" and flagged by signs such as prompt iteration titles, placeholder strings, and colorized console output, was followed about 30 minutes later by s5cmd and SharpShares, with data written to CSV, archived, exfiltrated to a remote server, and summarized in an AD_Report.html inventory report.
Why it matters: The barrier to entry has dropped: a less-skilled actor obtained aggressive, noisy AD enumeration tooling with minimal effort, and Huntress notes the hybrid approach prioritizes aggression and speed over stealth. Sygnia separately observed an AI-assisted AWS attack that went from initial access to broad compromise in about 72 hours, with the attacker repeatedly converting each new access key into renewed discovery, persistence, and exfiltration.
Read the original at The Hacker News ↗
- Topics
- AI Security
- Related
- SECURITY AFFAIRS AI-CYBERSECURITY NEWSLETTER ROUND 8 Cyber Risks · Nov 15, 2026Pentagon Renames CDAO ‘Super Intelligence Office’ Cyber Risks · Nov 15, 2026186 Fake AI Domains Redirect Users to Click Fix Lures, Browser Malware, and Search Hijackers Cyber Risks · Nov 12, 2026