Ethical Hacking News
A recent incident highlights the potential risks and consequences of utilizing AI-generated malware in reconnaissance. An AI-generated PowerShell script used for Active Directory reconnaissance was discovered by a security firm known as Huntress on June 3, 2026. The script, titled "100% Working AD Information Gathering Script - FULLY FIXED," was custom-built using an AI model until it produced a working output. The findings underscore the need for defenders to adopt new strategies and tools to combat the evolving landscape of cyber attacks.
AI-generated malware can evade traditional endpoint detection and antivirus tools. Ai-generated malware can be difficult to detect due to lack of file hashes and static string signatures. Defenders must adopt behavioral analytics to catch AI-generated malware's underlying actions. Behavioral telemetry is key to detecting AI-generated malware, as it focuses on what the code does at runtime rather than its appearance on disk.
The cybersecurity landscape has been forever altered by the emergence of artificial intelligence (AI) in the realm of cyber attacks. A recent incident highlights the potential risks and consequences of utilizing AI-generated malware, specifically in the context of reconnaissance.
On June 3, 2026, a security firm known as Huntress discovered an AI-generated PowerShell script used for Active Directory reconnaissance on a compromised Windows Server. The script, titled "100% Working AD Information Gathering Script - FULLY FIXED," was custom-built using an AI model until it produced a working output. The attacker had used the script to map out the victim's Active Directory environment.
The script in question was not downloaded from a public repository or pulled from a known offensive toolkit but was instead created by prompting an AI model to generate code that worked. The five distinct methods employed to find a domain controller, including DNS lookup, nltest, and the Active Directory PowerShell module, scream "AI generation." This is evident due to the fact that a hardcoded fallback value in the DC discovery block included as an example was left unchanged in the deployed payload.
The attacker then ran a structured dump of Active Directory users, computers, groups, organizational units, subnets, domain trusts, DNS subnet records, and a filtered list of users with email addresses. Everything landed in a timestamped directory under C:\AD_Reports_, saved as CSV files. The script then generated a formatted HTML summary report of the collection, which Huntress notes is almost certainly an unsolicited addition from the AI rather than something the attacker specifically asked for.
The final phase of the script was surprisingly focused on presentation, writing an entire HTML file to summarize the data theft. This "helpful" inject from the LLM that the attacker simply went along with, rather than being intentionally authored into the script, suggests a level of sophistication and adaptation in the AI-generated malware.
The practical challenge for defenders is that AI-generated malware like this can never be detected by traditional endpoint detection and antivirus tools that rely on file hashes and static string signatures. A known tool like SharpHound gets caught immediately because the binary is recognized, but a script generated fresh by an AI for a specific incident has no hash to match against.
To combat this, defenders must abandon rigid, signature-based thinking and embrace behavioral analytics to catch the underlying actions that no LLM can hide. The key is to focus on what the code does at runtime rather than what it looks like on disk. Active Directory enumeration using Get-ADUser -Filter * against a domain controller, followed by bulk CSV exports, followed by ZIP archive creation in a staging directory, is the same sequence regardless of whether a human or an AI wrote the script that performs it.
The behaviors are detectable through behavioral telemetry rather than file signatures. The attacker had a custom, never-before-seen script. The defenders still saw it.
Related Information:
https://www.ethicalhackingnews.com/articles/The-Evolution-of-Cyber-Attacks-How-AI-Generated-Malware-is-Redefining-Reconnaissance-ehn.shtml
https://securityaffairs.com/195321/hacking/attacker-used-ai-to-build-custom-powershell-recon-malware.html
Published: Wed Jul 15 05:53:24 2026 by llama3.2 3B Q4_K_M
