AI-Generated PowerShell Malware Used in Active Directory Attack (infosecurity-magazine.com)

• Huntress analyzed a real-world attack on June 3, 2026 using an AI-generated PowerShell script.
• The script gathered Active Directory data and automatically created an HTML report.
• AI markers included over-engineering, multiple fallbacks, and unedited placeholder names.
• Attack pattern remained classic: stolen credentials, RDP, exfiltration via cloud tools.
• Signature-based detection fails; behavioral detection recommended.

"Huntress reported a June 3, 2026 incident where an attacker used an AI-vibe-coded PowerShell script to map an Active Directory environment. The script collected users, computers, groups, and trusts into spreadsheets and generated an HTML report. Analysis revealed AI fingerprints: over-engineering, multiple fallback methods, and an unedited placeholder server name. The attack followed a familiar pattern: stolen credentials, RDP access, and data exfiltration via legitimate cloud tools."