Hackers Leverage AI

Gbhackers •Divya • June 3, 2026

A threat campaign in which attackers leveraged AI-powered tools to streamline Active Directory (AD) compromise and accelerate endpoint detection and response (EDR) evasion testing. The activity, observed on June 2, 2026, was triggered by suspicious files originating from the path C:\Users\User\Documents\test. Sophos investigation revealed a collection of malicious components forming a structured post-exploitation framework designed to […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

AI-Driven Malware Framework Automates EDR Evasion Tactics Sophos X-Ops analysts uncovered a threat actor utilizing AI technologies to develop a malware-testing framework aimed at evading endpoint detection and response (EDR) systems. The activity was detected on June 2, 2026, when alerts were triggered by suspicious payloads in a testing directory on a customer endpoint. The framework included multiple virtual machines running Windows Server 2022, testing against EDR solutions from Sophos, CrowdStrike, and Microsoft. The attacker employed AI tools such as Cursor and Claude Opus to automate Active Directory discovery and malware development processes. Despite the use of AI, the workflow remained human-driven, with significant reliance on human review and iteration. The investigation revealed that the malware was part of a broader cybercriminal operation, rather than a legitimate red team exercise. The malicious components were primarily Python scripts, many of which were AI-generated and written in Russian. The framework's sophistication raises concerns about the evolving capabilities of threat actors leveraging AI technologies. 16 sources 70

Extracted Entities

Hackers Leverage AI

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (1)

Platforms (1)