Malware Threat actor uses AI-generated malware in network intrusion July 9, 2026 Share By SC Staff A threat actor has been caught using AI-generated malware in a real network intrusion, deploying a PowerShell script that was "vibe-coded" to map out an Active Directory environment, according to Huntress. The script was recovered and rebuilt from an incident on June 3, serving as a case study in how criminals are weaponizing AI, with further coverage provided by Infosecurity Magazine. The AI-generated tool, titled "100% Working AD Information Gathering Script - FULLY FIXED," exhibited several hallmarks of LLM assistance, including a placeholder server name, over-engineering with multiple fallback methods, and a "pretty" console output using excessive colors, Huntress said. Once it located the domain controller, the script harvested Active Directory users, computers, groups, and trusts, compiling the data into spreadsheets and generating an HTML report. The intrusion itself followed a familiar pattern: the attacker used stolen credentials to log in via RDP, staged tools in a common Windows folder, and then ran the AI-generated script for network reconnaissance. Data exfiltration was handled using legitimate cloud tools. The primary challenge for defenders is detection, as the unique, one-off nature of the AI-generated script renders traditional signature-based antivirus methods ineffective. This trend highlights the need for behavioral analytics to detect underlying malicious actions rather than relying on known malware signatures. Source: Infosecurity Magazine SC Staff Related Malware Microsoft details GigaWiper destructive backdoor assembled from older tools SC Staff July 9, 2026 GigaWiper, written in Go, operates on Windows and presents operators with numbered commands, three of which are designed for system destruction. Malware New GoodPersonRAT malware distributed via fake LetsVPN installer SC Staff July 9, 2026 The trojanized installer, identified as Kuailian_win-setup.86.msi, embeds a loader and an encrypted payload alongside the authentic LetsVPN application. Malware Armored Likho APT leverages AI-generated malware and BusySnake Stealer SC Staff July 9, 2026 Armored Likho utilizes a modular and evolving toolkit that includes obfuscated remote access trojans (RATs), the Python-based BusySnake Stealer, and Go2Tunnel for network tunneling. Get daily email updates SC Media's daily must-read of the most current and pressing daily news Business Email By clicking the Subscribe button below, you agree to SC Media Terms of Use and Privacy Policy . Subscribe Related Terms Adware You can skip this ad in 5 seconds