How AI Revived a Stalled Attack on a U.S. Retailer

In September 2026, attackers targeting a U.S. retailer shifted from error-prone manual commands to AI-generated PowerShell scripts, enabling rapid and effective exploitation. The AI-assisted attacks included credential harvesting from SolarWinds Orion software and lateral movement across servers. These attacks were financially motivated, focusing on point-of-sale systems to extract passwords and credentials. The intrusion was linked to earlier attacks in 2026 that lacked AI assistance, indicating recent integration of AI capabilities. Similar AI-assisted attacks increased across multiple sectors and countries throughout 2026.

• Iranian State-Aligned Threat Actor Masquerading as Dubai Airports IT Department Delivering Trojanized Coding Challenges - Blinder Tunnel Campaign Targeting Iraqi Critical InfrastructureMalware2026-10-07
• SCKit Worm Installs Rogue ScreenConnect Clients and Session Cookie Relays Across Hundreds of EndpointsMalware2026-11-12
• Analysis of Wpcdoor Attack Case Distributed Through Domestic DVR Management SoftwareMalware2026-11-11
• Beyond the clipboard: The evolving tradecraft of ClickFixMalware2026-11-10
• A New ESXi Implant Linked to Settra RansomwareMalware2026-11-10