Cybersecurity company, Huntress, recovered and rebuilt an AI-generated malware script from an incident that occurred in June 2026.

The cyber criminal allegedly got access to the system with stolen credentials and logged in using remote desktop protocol (RDP). After the valid login, the attacker used the AI-generated script to scout the network for information, locating the controller. The attacker then harvested active directory users, computers, groups, and trusts into spreadsheets. Legitimate cloud tools were responsible for the data exfiltration.

According to Huntress, the malware had several identifiers that indicated it was generated by AI, including a placeholder server name the AI supplied as an example that was left in. Other signs included five different fallback methods where a human would have picked one, a preference for colorful console output, errors, and an HTML report summarizing the theft run after it was completed.

Source: https://www.infosecurity-magazine.com/news/vibe-coded-malware-ai-powershell/

Commentary

The above attack was executed via AI-generated malware. The initial intrusion, however, began with one of the oldest schemes in the book - stolen credentials.

The cyber criminal initiated the attack using stolen credentials and executed the attack via an exposed RDP entry point.

To help avoid the classic risks, like stolen credentials, consider the following:

· Enforce phishing resistant multi-factor authentication on every remote access path, including RDP

· Monitor and immediately investigate unusual administrative access and first-time-seen device connections

· Rotate service and administrator credentials periodically and revoke access promptly at employee departure

· Conduct annual cybersecurity training that emphasizes the importance of strong, unique passwords

· Provide realistic phishing examples and train staff on how to spot and not fall for phishing messages

The final takeaway is AI-generated malware is making the news for good reason, but cybersecurity risk mainstays - such as stolen credentials - are still risks organizations need to consider.