A US retailer recently fell victim to a sophisticated cyberattack that leveraged artificial intelligence (AI) to breach its defenses. The attack, which was detailed by security firm Symantec, showcases the growing trend of threat actors using AI-generated scripts to achieve their goals.
The incident began when hand-typed commands failed to gain traction against the retailer’s security systems. Undeterred, the attacker switched to AI-generated scripts, which were able to rapidly break through the defenses and harvest credentials. Within minutes, the threat actor had achieved lateral movement within the network.
Symantec believes that the use of AI in this attack was a deliberate choice by the attacker, who realized that hand-typed commands were being detected and blocked by security software. By using an AI model to generate scripts, the attacker was able to evade detection and achieve their objectives.
This incident is not an isolated case, as Symantec has reported investigating dozens of similar attacks since May. The use of large language models (LLMs) in cyberattacks has been on the rise, with threat actors utilizing them to generate convincing phishing lures, conduct data reconnaissance, and even execute end-to-end attacks.
In this specific incident, the attacker’s tactics changed when they switched from hand-typed commands to AI-generated scripts. They submitted long, error-free PowerShell scripts with labeled output sections and comments that read like a model’s reasoning. Approximately 10 minutes after querying the victim’s SolarWinds Orion monitoring software, the attackers managed to laterally move to a second server.
Symantec’s analysis suggests that the attacker was likely financially motivated, as they searched for passwords in point-of-sale scripts and contacted an address linked to an operation that stole card data from online retailers.
The use of AI in this attack presents a new challenge for defenders. Dick O’Brien, principal intelligence analyst on the Symantec Threat Hunter Team, notes that while AI can accelerate attacks, it also creates patterns that can be detected by security software. “Treating a blocked attempt followed by a variant as a high-priority alert is worth considering,” he advises.
While no vulnerability was exploited and no patching was required in this incident, the trend of AI accelerating attacks will continue to affect the patching race. As O’Brien notes, defenders need to start looking at mean time to mitigate (MTT) and focus on blocking behavior rather than file names or exact commands. By doing so, they can stay ahead of the attackers and prevent similar incidents from occurring in the future.
For readers, this incident serves as a reminder that AI-powered attacks are becoming increasingly common. To protect themselves, it’s essential to adopt a proactive approach to security, focusing on behavior-based detection and blocking rather than relying solely on traditional signature-based methods. By staying vigilant and adapting to the evolving threat landscape, individuals and organizations can reduce their risk of falling victim to such attacks.
Source: Dark Reading — 2026-11-12