Attacker Used AI to Build Custom PowerShell Recon Malware

Huntress investigators recovered a custom, likely AI‑generated PowerShell AD enumeration script (Untitled1.ps1) used shortly after RDP access to map Active Directory and export CSVs, followed by deployment of s5cmd and SharpShares for likely data theft; the report warns that AI lowers the barrier to bespoke malicious tooling and recommends focusing on behavioral detection rather than signature-based methods.