Back Securityaffairs.Co

Attacker Used AI to Build Custom PowerShell Recon Malware

Securityaffairs.Co •Pierluigi Paganini • July 14, 2026

Huntress found an AI-generated PowerShell script used for AD reconnaissance, showing attackers are using AI to create custom, evasive tools. During an incident response investigation on June 3, 2026, Huntress analyst Jevon Ang recovered a PowerShell script from a compromised Windows Server that the attacker had used to map out the victim’s Active Directory environment. […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

AI-Generated PowerShell Script Used for Active Directory Reconnaissance A threat actor employed an AI-generated PowerShell script to conduct reconnaissance in a compromised Active Directory environment. The attack began with unauthorized access to a domain-joined Windows Server via Remote Desktop Protocol using stolen credentials. The intruder staged tools in the ProgramData directory and executed a script to map users, groups, and domain controllers. The incident was identified during an investigation by Huntress on June 3, 2026. This highlights the increasing use of AI in creating custom, evasive malware. The specific impact on the victim organization remains unclear, but the use of AI tools indicates a sophisticated approach to cyber intrusions. The situation is ongoing as security teams respond to the incident. 2 sources 67

Extracted Entities

Attacker Used AI to Build Custom PowerShell Recon Malware

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (2)

Platforms (2)

Tools (1)