Attacker Uses AI-Written PowerShell Script to Map a Company's Network

Key points

• Researchers found an intrusion where an unknown attacker ran a PowerShell script that appears to have been written with the help of an AI coding assistant.
• The script mapped Active Directory, the central directory Windows networks use to manage staff accounts and computers.
• It located the Domain Controller, listed users and computers across domains, and saved the results into a file called AD_Report.html.
• The findings were first reported by The Hacker News, and point to a wider trend of attackers using AI to draft their tools.
• Defenders should watch for unusual PowerShell activity and unexpected directory queries from ordinary user accounts.

Security researchers have flagged an intrusion that offers a rare look at how attackers are starting to use AI to write their own tools.

The intruder ran a PowerShell script inside a victim's Windows network. PowerShell is a built-in scripting tool that ships with every modern version of Windows and is often used by IT staff for routine admin work. That familiarity is exactly why attackers like it.

What caught the researchers' attention was the shape of the code. It read less like something a seasoned hacker would write by hand and more like something a chatbot produced: heavy comments, tidy variable names, defensive error handling in places a human attacker wouldn't usually bother. The Hacker News, which surfaced the research, noted that the code carried the hallmarks of AI-assisted development rather than a polished, hand-crafted tool.

What did the script actually do?

It quietly took a full inventory of the victim's network.

The script first located the Domain Controller, the central server that holds the master list of accounts and computers in a Windows network. From there it queried Active Directory, the directory service that keeps track of who is who inside an organisation. It then pulled account and machine data across domains, created a working folder, and exported the results into a series of files. The final step was a summary file called AD_Report.html, which the attacker could open in a browser to confirm the enumeration had worked.

In plain terms, the intruder printed themselves a map of the building before deciding which doors to try.

Why this matters even if you have never heard of PowerShell

Mapping the network is usually one of the first moves in a serious intrusion. Once an attacker knows which accounts carry admin rights and where the sensitive servers are, everything that follows becomes much easier: moving between machines, stealing data, deploying ransomware.

The AI angle is the part worth watching. Writing a working Active Directory enumeration script used to take real skill. If less experienced criminals can now ask a chatbot to draft one, the barrier to entry drops. Threat Vectr first covered AI-generated malware on 6 July 2026, with BusySnake; this case fits the same pattern, just applied to reconnaissance rather than persistence.

Researchers did not publicly attribute the activity to a named group.

What defenders should be looking for

The activity leaves fingerprints, if anyone is watching.

Ordinary user accounts should almost never be running bulk Active Directory queries or writing HTML reports to disk. Security teams can look for PowerShell launching from unusual locations, sudden bursts of directory lookups from a single workstation, and any process creating files named like reports or dumps in a user's temp folder. Turning on PowerShell script block logging, which records exactly what scripts do when they run, makes this kind of behaviour much easier to catch after the fact.

Should ordinary staff worry?

Not directly, but they're still the front door.

Attackers typically get their initial foothold through a phishing email or a stolen password, not through the enumeration script itself. That script runs only once the intruder is already inside. So the practical advice for staff hasn't changed: be sceptical of unexpected login prompts, use multi-factor authentication where it's offered, and report anything odd to IT quickly. The earlier someone notices, the less time the attacker has to draw their map.