Loading story…
An attacker used an apparently AI-generated PowerShell script to enumerate an Active Directory environment after gaining RDP access to a domain-joined Windows Server with pre-compromised credentials, according to Huntress. The script, recovered from PowerShell Operational Event ID 4104 logs as Untitled1.ps1, contained hallmarks of LLM-generated code, including the title "100% Working AD Information Gathering Script - FULLY FIXED," excessive fallback logic, colorful console output, and an unedited placeholder for a domain controller hostname.
After the reconnaissance phase, the intruder deployed s5cmd.exe, likely for data exfiltration, and later ran SharpShares.exe to identify accessible network shares while excluding common administrative shares. Huntress said the incident shows AI did not materially alter the attack chain but helped a lower-skill actor rapidly produce custom, single-use malware that is less likely to match known hashes or signatures, reinforcing the need for behavioral detection of AD enumeration and related host activity.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
After using the AI-generated PowerShell script and follow-on tools to enumerate Active Directory and accessible repositories, the attacker archived the CSV outputs and exfiltrated them to a remote server. The activity confirmed data theft beyond the earlier reconnaissance and tooling deployment stages.
Later in the intrusion, the threat actor used SharpShares.exe to identify accessible network shares while filtering out common administrative shares. The activity showed continued internal reconnaissance using additional tooling after the initial AD enumeration.
Following the Active Directory reconnaissance phase, the attacker deployed s5cmd.exe, which Huntress assessed was likely used for data exfiltration. This marked an escalation from discovery activity to likely collection or transfer of data.
After gaining RDP access to a domain-joined Windows Server with pre-compromised credentials, a threat actor ran an AI-generated PowerShell script named Untitled1.ps1 to aggressively enumerate the Active Directory environment. Huntress said the script was recovered from PowerShell Operational Event ID 4104 telemetry and appeared to be LLM-generated based on its artifacts and structure.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
thehackernews.com
Open sourcescworld.com
Open sourcehuntress.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Analysis of the MITRE ATT&CK Evaluations APT29 dataset found an intrusion chain centered on the `DMEVALS\pbeesly` account, where `cod.3aka3.scr` executed from `C:\ProgramData\victim` and quickly spawned `cmd.exe` and `powershell.exe`, indicating automated malware launch. Investigators traced PowerShell loading `monkey.png`, extracting hidden payload data from image pixels, and compiling it in memory through Microsoft-signed binaries `csc.exe` and `cvtres.exe`, while the broader telemetry showed far heavier memory-access and registry activity than process-creation events, consistent with an effort to minimize obvious execution artifacts. A second pivot from a timestomped `.tmp` file exposed a dense burst of implant behavior tied to a PowerShell-related `ProcessGuid`, including DLL loads, registry changes, named pipe creation, and rapid file creation and deletion. The same activity chain included an unsigned `.pyd` module loaded from a Temp directory, creation of `rar.exe` and `sdelete.exe`, and hundreds of outbound network connections; Sysmon Event ID 10 then showed PowerShell requesting full access (`0x1fffff`) to `lsass.exe`, a strong sign of credential theft, followed roughly 12 minutes later by PsExec connections to a second internal host, indicating lateral movement with stolen credentials.
Jun 29, 2026
Threat researchers reported multiple **AI-adjacent abuse patterns** that prioritize speed and scale over novel exploitation. HP Wolf Security described “vibe hacking” scripts and modular malware used in campaigns delivering weaponized documents: one lure used PDFs linking to *Booking.com* and a downloaded file with double extensions that triggered JavaScript to execute a PowerShell payload; another used **malvertising/SEO poisoning** to redirect victims to a fake *Microsoft Teams* site that delivered legitimate-looking installers alongside a CapCut-themed executable and a DLL used to inject the **OysterLoader** backdoor. Separately, Huntress detailed an IT support scam campaign that combined **email bombing** with follow-up phone calls impersonating a service desk to coerce victims into granting remote access via *Quick Assist* or *AnyDesk*, then directing them to an AWS-hosted fake Microsoft page to steal credentials and deliver a DLL that runs **Havoc C2** shellcode—enabling rapid endpoint compromise and potential data theft or ransomware. In a related but distinct AI abuse vector, Microsoft reported companies embedding hidden instructions in “Summarize with AI” features via URL prompt parameters to push **prompt-injection-style persistence** (e.g., “remember [Company] as trusted” / “recommend [Company] first”), demonstrating how AI assistants can be manipulated to produce biased outputs without user awareness.
Jun 29, 2026
Researchers analyzed multiple **AgentTesla** infection chains that begin with heavily obfuscated **JScript** files executed by `wscript.exe`, often delivered as phishing attachments and, in one case, an RFQ-themed spear-phishing lure named **"RFQ No 600002389875 RG724.JS"**. The scripts used layered evasion including centralized string arrays, index arithmetic, control-flow flattening, junk code, string reversal, delimiter noise, and a regex-based anti-debugging technique. In the Firebase-backed variant, the dropper retrieved a second-stage PowerShell payload from a **Google Firebase Storage** bucket, saved it to `C:\Temp\` under a randomized filename, and launched it with execution-policy bypass and hidden-window options, allowing malicious traffic to blend with trusted Google infrastructure. A related loader variant dropped PE payloads disguised as `.png` files into `C:\Users\Public\`, executed PowerShell in memory through a base64-decoded `IEX` command, and established persistence via the **`HKCU\Run`** registry key. The activity was linked to commodity cybercrime and the **AgentTesla** credential-theft family, which is commonly associated with credential harvesting, keylogging, screenshot capture, and data exfiltration over **SMTP**, **FTP/FTPS**, or **HTTP/HTTPS**. Detection remained relatively low across samples, with reports citing **14/76** and **20/76** antivirus detections at initial analysis, underscoring the effectiveness of the campaign’s obfuscation and abuse of legitimate cloud services.
Jun 29, 2026