Vibe-Coded Malware Caught in Active Directory Attack

Huntress recovered an AI-assisted PowerShell tool used in a June intrusion that automated Active Directory discovery and produced HTML reports; the attacker logged in via RDP with stolen credentials, staged tools, and exfiltrated data using legitimate cloud utilities (s5cmd, SharpShares). The report argues that "vibe coding"—prompting an LLM to generate code—lowers the barrier for attackers, creates one-off malicious artifacts that defeat signature-based detection, and forces defenders to adopt behavioral analytics to detect the underlying actions.