AI-Generated 'Vibe-Coded' Malware Caught Mapping Active Directory in Live Attack

Vibe coding is the process of generating functional software by iteratively prompting an AI in plain language until the output performs the desired task. In software development, this approach has made programming accessible to non-developers. In cyberattacks, it hands any criminal the ability to build bespoke, one-off attack tools without any programming background.

The critical operational advantage vibe-coded attack tools provide is not capability. Most of what an AI generates follows well-documented attack patterns already captured in threat databases. The advantage is uniqueness. Every AI-generated script is written from scratch on each iteration, meaning no two instances share identical code structure, variable names, function signatures, or logic flow. File hashes, YARA signatures, and code patterns that antivirus and endpoint detection tools use as lookup keys are useless. A vibe-coded tool arrives at every target as a brand-new executable no database has ever indexed.

Unit 42's 2026 Global Incident Response Report documents the practical result: the fastest 25% of intrusions now reach data exfiltration in 1.2 hours, down from 4.8 hours the prior year, a 75% reduction driven primarily by AI-assisted reconnaissance and lateral movement automation. Attackers using AI-generated tools no longer need to adapt generic malware frameworks, debug compiled binaries, or wait for forum access to purchase an exploit kit.

The attacker provides the objective. The AI writes the tool. The attacker pastes and executes.

CrowdStrike's 2026 Global Threat Report documents an 89% increase in attacks by AI-enabled adversaries year-over-year, with attackers moving from experimental AI use to routine operational deployment. The Huntress incident confirms the bottom end of this trend: even commodity attackers without technical backgrounds are now vibe-coding their entire toolsets.

The threat actor had already obtained valid RDP credentials before deploying the vibe-coded script. The original source of those credentials was not confirmed by Huntress, though VPN credential compromise is the leading hypothesis based on the attack pattern. Once the attacker established an RDP session on a domain-joined Windows Server, the AI-generated script was staged to "C:\ProgramData\Untitled1.ps1" and executed within minutes.

The script performed a systematic sweep of the Active Directory environment through a five-step cascading fallback mechanism for domain controller discovery: DNS queries, nltest, the Active Directory PowerShell module, environment variables, and a hardcoded placeholder hostname. After locating the domain controller, it enumerated every user account, computer object, group and group membership, organizational unit, subnet, and domain trust relationship. It saved eight separate CSV files to a timestamped output directory and generated a polished HTML summary report measuring enumeration success. The entire output was then packaged into a zip file.

Approximately 30 minutes after the script executed, the attacker deployed "C:\ProgramData\s5cmd.exe," a legitimate Amazon S3 command-line utility, to exfiltrate the zip archive to an attacker-controlled S3 bucket. The attacker also ran "SharpShares.exe" to identify user-accessible file shares beyond standard administrative shares, extending the reconnaissance to the organization's file storage layer.

The same pattern of AI-assisted tooling appeared two weeks earlier at the nation-state level. APT28's LAMEHUG malware used a live LLM API to generate command-and-control instructions mid-operation, demonstrating that AI-generated tooling has spread from ransomware operators to state-sponsored actors and now to opportunistic criminals with no group affiliation. The attack surface for AI-generated offensive tooling spans the entire threat actor spectrum.

The script betrayed its AI origin through five technical artifacts that Huntress researchers documented as replicable detection indicators for blue teams.

The first was the title. "100% Working AD Information Gathering Script - FULLY FIXED" reflects the iterative error-correction cycle visible in any AI coding session. No human developer names a production attack tool with this phrasing; it reads like the AI's response summary after a debugging loop.

The second was an unedited placeholder. The domain controller discovery fallback contained a literal example hostname from the LLM's training data that the attacker never replaced before execution. The script ran with the example hostname embedded, meaning it would have fallen back to a non-existent value in any environment where the primary discovery methods failed.

The third was over-engineering. The DC discovery mechanism used five distinct methods in sequence. A human developer with knowledge of the target environment would write one or two optimal methods. LLMs reproduce all approaches from training data simultaneously rather than selecting the correct one.

The fourth was decorative output. The script contained saturated colored "Write-Host" commands producing cyan headers, green success indicators, red failures, and yellow warnings. Human attackers writing disposable reconnaissance tools do not add color schemes. LLMs add them because they appear in training data for user-friendly terminal applications.

The fifth was the HTML report. A polished HTML summary was generated automatically with formatted tables measuring enumeration success. The attacker did not need this report for operational purposes. The LLM added it as a "helpful" feature beyond what was requested, a behavior pattern consistent across LLM-generated tooling.

These artifacts are not just evidence of AI authorship. They are behavioral detection anchors that remain consistent regardless of how the underlying code is restructured.

Every organization running Active Directory is a potential target for AI-generated reconnaissance at this threat level. The specific capability that vibe coding unlocks is not technical sophistication. It is entry-level access to bespoke tool generation for any attacker who can type a request.

Signature-based antivirus and endpoint detection tools protect against known threats. AI-generated malware is unknown by construction. The AI-built ransomware toolkit that bypassed 70-plus EDR controls in a live campaign documented in June 2026 demonstrated the same principle at the payload level: AI-iteratively-refined code eventually produces variants that evade any static signature set. The vibe-coded reconnaissance script demonstrates identical evasion at the reconnaissance phase.

The threat extends beyond the specific script Huntress analyzed. Any attacker who can follow instructions can now generate a custom Active Directory enumeration script, a custom process injector, a custom data stager, or a custom persistence mechanism. Each generation produces a unique artifact with no prior detection record.

Organizations that have historically categorized low-skilled threat actors as lower-priority risks based on their limited tooling access need to update that assessment. The tooling barrier no longer exists. A criminal with an API key and a clear objective can produce functional, signature-evading attack tools for any phase of an intrusion.

The sectors most exposed are those where Active Directory is the backbone of identity infrastructure and where incident response teams lack the behavioral detection maturity to catch what hashes cannot flag: healthcare, financial services, critical infrastructure, and government agencies.

No CVE-specific Sigma rule exists for vibe-coded malware because this threat class has no CVE identifier. AI-generated attack tools are not a software vulnerability; they are a technique for producing novel offensive tooling. Detection focuses on the behaviors these tools produce rather than the tools themselves.

The two core log sources for detection are Microsoft-Windows-LDAP-Client/Debug ETW logging, which captures LDAP search filter patterns consistent with Active Directory enumeration, and Windows PowerShell Script Block Logging (Event ID 4104), which records the full content of every PowerShell script executed regardless of obfuscation or uniqueness. Script Block Logging is what allowed Huntress to recover and analyze the vibe-coded script after execution. Without it, the script would have left no recoverable artifact.

The third detection layer covers the exfiltration phase. Cloud CLI tools like s5cmd, rclone, AzCopy, and AWS CLI, when executed from non-IT accounts or from directories like C:\ProgramData, represent a behavioral anomaly that SIEM rules can catch regardless of the specific binary name. The Rclone detection rule below covers the same exfiltration-via-cloud-CLI behavior pattern that s5cmd represents, applied to any cloud sync utility appearing outside approved tooling.

Use sigma-cli to convert the YAML below to Splunk SPL, Microsoft Sentinel KQL, or Elastic ESQL. Deploy the LDAP and PowerShell rules to domain controllers first; deploy the cloud CLI exfiltration rule across all endpoints.

The June 3, 2026 intrusion produced no network-layer IOCs suitable for blocklist deployment. The attacker used legitimate cloud infrastructure for exfiltration, making the destination indistinguishable from authorized Amazon S3 traffic at the network level.

The actionable detection artifacts are behavioral and filesystem-based.

Behavioral and telemetry-based detection is the only reliable control against AI-generated attack tooling. Signature-based detection cannot index code that did not exist before this attack.