Attacker Uses Suspected AI-Generated PowerShell Script to Map Active Directory
13:02 · July 13, 2026 · Hacker News AI Section
Cybersecurity researchers have flagged an intrusion in which an unknown threat actor leveraged a vibe-coded PowerShell script for Active Directory (AD) enumeration. "The script looked for the Domain Controller (DC) and mapped users, computers, and domains, before creating a directory and exporting out a number of files, and finally creating AD_Report.html to measure the success of the
Summary
Cybersecurity researchers at Huntress documented an intrusion in which an attacker used a PowerShell script assessed as AI-generated to perform rapid Active Directory enumeration. After gaining Remote Desktop access with stolen credentials on a domain-joined Windows Server, the operator staged the script in C:\ProgramData\. The script first located the domain controller through a five-step cascading fallback mechanism, then collected details on users, computers, groups, organizational units, and trusts before writing the results to CSV files and generating an HTML summary report titled AD_Report.html.
Telltale indicators of large-language-model assistance included the script title “100% Working AD Information Gathering Script - FULLY FIXED,” placeholder strings, multiple redundant methods for discovering a domain controller, and console output formatted in cyan, green, red, and yellow. Roughly thirty minutes later the attacker deployed the legitimate bulk-transfer utility s5cmd together with the C# share-enumeration tool SharpShares, archived the harvested data, and exfiltrated it to an external server. Huntress characterized the script as noisy and aggressive, noting that the underlying attack sequence followed the familiar smash-and-grab pattern while the AI contribution mainly accelerated reconnaissance and reduced the skill required to produce functional tooling.
A separate report from Sygnia described an AI-assisted campaign against a large AWS environment that moved from initial access to broad compromise in approximately seventy-two hours. The actor repeatedly converted newly obtained credentials into further discovery, secret harvesting, persistence via IAM users and access keys, and data exfiltration, chaining weaknesses across applications, source repositories, CI/CD pipelines, and data stores. No novel malware or zero-day exploits were observed; instead, AI shortened the time needed to operationalize established cloud techniques at a scale and speed that outpaced typical defensive response.
Why it matters
This article is highly relevant for security professionals as it demonstrates how threat actors are actively using LLMs to generate aggressive reconnaissance scripts and accelerate cloud attacks. It highlights that while AI may not create novel zero-days, it significantly lowers the barrier to entry and increases the speed of intrusions, requiring enterprises to adapt their detection and response strategies.
