Ledger / 3 Jun 2026
Vibe-coded PowerShell script maps Active Directory during intrusion
Strong
Huntress rebuilt the script from logs and cites chatbot-style title, unedited placeholder host and over-engineered fallbacks.
During a live intrusion the actor ran a script titled as a finished chatbot debugging session, with a leftover placeholder hostname. Huntress argues behavior-based detection is needed because such scripts are unique each time.
“The script, enthusiastically titled "100% Working AD Information Gathering Script - FULLY FIXED”Huntress
Sources
- AI-Coded Malware: vibe coding Active Directory enumerationHuntress · 8 Jul 2026 · primary source
- Date
- 3 Jun 2026
- Disclosed
- 8 Jul 2026
- Actor
- Unidentified (unknown), as attributed by Huntress
- Targets
- Victim organization accessed via compromised remote credentials over RDP
- What the AI did
- Malware dev, Recon
- Model
- unspecified AI chatbot
- Model family
- Unspecified
- Model basis
- inferred
- Autonomy
- assist
- Outcome
- AD users, computers, groups and trusts enumerated and zipped for exfiltration; s5cmd and SharpShares followed.