AI-Coded Malware | Analyzing Vibe-Coded AD Enumeration | Huntress

The report describes a June 3 intrusion in which an attacker used pre‑compromised credentials to pivot via RDP on a domain-joined server, deploy an AI‑generated PowerShell AD enumeration script (Untitled1.ps1), and later stage/exfiltrate data using s5cmd and SharpShares; the analysis highlights hallmarks of LLM-generated “vibe‑coded” tooling and recommends shifting from signature‑based detection to behavior analytics.