Threat actor uses AI-generated malware in network intrusion

A threat actor was caught using AI-generated malware during a real network intrusion. The malware took the form of a PowerShell script that was 'vibe-coded' — a term indicating it was generated with the assistance of a large language model. The script was designed to map an Active Directory environment.

The script exhibited specific hallmarks of LLM assistance, including a placeholder server name and evidence of over-engineering. These characteristics suggest the code was not written by a human but generated by an AI model. The intrusion was detected and reported by cybersecurity researchers, though the specific threat actor and target were not disclosed in the brief.

This incident highlights the growing use of AI by malicious actors to automate and enhance their attacks. AI-generated code can lower the barrier to entry for less skilled attackers while also producing more complex scripts. The presence of distinctive LLM artifacts, such as placeholder names and unnecessary complexity, may aid defenders in identifying AI-generated malware. The cybersecurity community continues to monitor these developments.