Attacker Uses Suspected AI-Generated PowerShell Script to Map Active Directory

Researchers observed an intrusion where an attacker used pre-compromised credentials to RDP into a domain-joined Windows server, staged an AI-assisted PowerShell AD enumeration script in C:\ProgramData to harvest users, computers, groups and trusts, packaged results (CSV/HTML) and exfiltrated them; Huntress characterizes the script as noisy and LLM-augmented. Separately, Sygnia reported an AI-enabled cloud attack in AWS that moved from initial access to broad compromise within ~72 hours, focusing on credential reuse, secrets harvesting, persistence (new IAM keys/users), disruption (S3/ECS/SQS manipulation) and extortion, illustrating AI as a force multiplier rather than a source of novel techniques.