Cybersecurity researchers flagged an intrusion in which an unknown threat actor leveraged a vibe-coded PowerShell script for Active Directory enumeration, occurring in early June 2026. The attack chain involved establishing Remote Desktop Protocol access onto a domain-joined Windows Server with pre-compromised credentials, staging tools in the "C:\ProgramData\" folder, and using an AI-generated payload to map the Active Directory environment. The script, titled "100% Working AD Information Gathering Script - FULLY FIXED," looked for the Domain Controller, mapped users, computers, and domains, created a directory, exported files, and created AD_Report.html. Huntress described the script as "highly aggressive" and "noisy," using a "five-step cascading fallback mechanism." About 30 minutes later, the attacker deployed s5cmd and SharpShares to look for user-accessible data repositories. Data was saved into CSV files, archived, and exfiltrated to a remote server, with an HTML file summarizing the data theft. Researchers noted the development lowers the barrier to entry for cybercrime, permitting less-skilled actors to produce capable tooling, while the underlying attack chain remains a consistent smash-and-grab playbook now augmented by AI.