AI-Coded Malware Uses Vibe Coding to Map Active Directory Environments

Threat actors are now weaponizing AI-generated PowerShell scripts to enumerate Active Directory (AD) environments, according to new findings from Huntress. The discovery, tied to an incident on June 3, signals a shift in tradecraft that could complicate signature-based detection for years to come. Vibe coding refers to building software by iteratively prompting an AI in […] The post AI-Coded Malware Uses Vibe Coding to Map Active Directory Environments appeared first on Cyber Security News.

Threat actors are now weaponizing AI-generated PowerShell scripts to enumerate Active Directory (AD) environments, according to new findings from Huntress. The discovery, tied to an incident on June 3, signals a shift in tradecraft that could complicate signature-based detection for years to come. Vibe coding refers to building software by iteratively prompting an AI in natural language rather than manually writing code, thereby allowing even low-skill attackers to produce custom, single-use malicious tools. Unlike established frameworks such as BloodHound, PowerSploit, or Cobalt Strike, which defenders can flag using known signatures, these AI-generated scripts are unique each time and evade traditional hash-based detection. Vibe Coding to Map Active Directory Environments The intrusion followed a familiar smash-and-grab pattern, now accelerated by AI assistance rather than fundamentally altered by it. It began with an RDP pivot, in which the attacker used pre-compromised credentials to access a domain-joined Windows Server, likely via VPN. Operations were then staged in C:\ProgramData, a common attacker directory, before the attacker executed Untitled1.ps1 within minutes of establishing the session, a bespoke AI-generated script designed to map the AD environment. Roughly 30 minutes later, the attacker moved into the smash-and-grab phase, deploying s5cmd.exe, a legitimate Amazon S3 tool frequently abused for data exfiltration. The attacker then went back for a second bite, running SharpShares.exe, a known enumeration tool, to hunt for additional accessible file shares beyond standard admin shares. Huntress reconstructed the entire script using Windows Event ID 4104 telemetry from PowerShell/Operational logs. Titled “100% Working AD Information Gathering Script – FULLY FIXED,” the tool used an over-engineered, five-step fallback method spanning DNS, nltest, the AD module, environment variables, and a hardcoded fallback, just to locate a single Domain Controller. Active Directory report (Source: huntress) It then systematically exported AD Users, Computers, Groups, OUs, Subnets, and Trusts to CSV files in a timestamped directory, compiled everything into a polished AD_Report.html, and zipped the results. Several details expose the script’s AI origins. The title itself reflects classic prompt-iteration behavior, where an attacker fed error messages back to an LLM until it produced a “fully fixed” version. A leftover placeholder value, “Server1.HR.local,” in the fallback code shows that the attacker copied and pasted AI output without customizing it. The script’s excessive fallback logic and heavy use of color-coded console output are also hallmark traits of LLM-generated code trying to appear thorough and “helpful” to the operator. Because vibe-coded scripts are one-off creations, signature-based detection tools largely fail against them. Huntress stated that while AI can rewrite code syntax infinitely, it cannot hide the operational footprint of interacting with AD, meaning defenders should prioritize behavioral analytics over static signatures. SIEM reportedly caught this activity by monitoring the underlying behavioral patterns of enumeration rather than relying on known malware hashes. Vibe coding lowers the technical barrier to cybercrime, but the fundamentals of attack-lifecycle detection, including enumeration, staging, and exfiltration, remain unchanged and detectable through behavior-focused monitoring. Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google. The post AI-Coded Malware Uses Vibe Coding to Map Active Directory Environments appeared first on Cyber Security News.