In September 2026, attackers targeting a U.S. retailer shifted from error-prone manual commands to AI-generated PowerShell scripts, enabling rapid and effective exploitation. The AI-assisted attacks included credential harvesting from SolarWinds Orion software and lateral movement across servers. These attacks were financially motivated, focusing on point-of-sale systems to extract passwords and credentials. The intrusion was linked to earlier attacks in 2026 that lacked AI assistance, indicating recent integration of AI capabilities. Similar AI-assisted attacks increased across multiple sectors and countries throughout 2026.