Malicious PowerShell script pushing malware looks AI-written

Proofpoint researchers observed TA547 using a PowerShell-based, likely LLM-assisted loader in a March phishing campaign impersonating Metro Cash & Carry to deliver the Rhadamanthys infostealer to dozens of German organizations; attackers distributed password-protected ZIPs containing .LNK shortcuts that launched a PowerShell script which decoded and executed Rhadamanthys entirely in memory, and the script's unusually extensive, well-formed comments and variable names led investigators to suspect generative AI was used to craft the code.