In September 2026, attackers targeting a U.S. retail organization initially used manually typed commands that were consistently blocked, but then switched to AI-assisted, complex PowerShell scripts that enabled rapid credential harvesting and lateral movement across servers within minutes. The AI-generated commands featured structured output, error handling, and explanatory comments, allowing the attackers to quickly exploit SolarWinds Orion monitoring software to move laterally using Erlang RPC calls, reflecting an operator relaying information through an AI tool rather than autonomous malware. This case is part of a broader surge in AI-assisted attacks that accelerate attackers’ ability to adapt and persist using known tactics without introducing new techniques.
https://www.security.com/threat-intelligence/ai-assisted-attack-us-retailer