Attacker Used AI to Build Custom PowerShell Recon Malware

Multiple active threats and incidents reported: Huntress discovered an AI-generated PowerShell reconnaissance script used to map Active Directory during a June 3, 2026 intrusion. Japan’s largest taxi operator Nihon Kotsu suffered a malware infection and service shutdown. A new macOS infostealer, CrashStealer, uses signed apps to bypass Gatekeeper, steals credentials and wallets, and AES-encrypts exfiltrated data. Lidl disclosed a third-party data breach affecting online-shop customers in Germany, Belgium and the Netherlands (payment data reportedly not exposed). CISA added Cisco IOS CVE-2008-4