AI-Generated Scripts Used in Malicious Attack Chains
cyb3rops · x · 2026-07-19
A blog post detailing the recent tactical evolution of TAG-150, breaking down its infection chain across DinDoor, DenoRAT, NightshadeC2.
The general attack chain unfolds as follows:
- ClickFix / MSI induced execution
- Triggers AI-generated PowerShell
- Downloads and executes DinDoor and DenoRAT
- Ultimately executes NightshadeC2 in memory via a Python loader
The included screenshots showcase specifics of the PowerShell scripts, DenoRAT, NightshadeC2, and persistence mechanisms, highlighting how attackers string together multi-stage payloads with scripted execution.
More from Safety
- Thieves spoofing GPS steal $100M+ in data center cargo since June — Ars Technica AI · 2026-10-27
- Johns Hopkins Alerts 3,000+ Patients After Data Was Sent to an AI Tool — beingmodest · 2026-10-27
- Alignment Hub launches with 120+ documented AI misbehavior incidents and a reporting template — Thom_Wolf · 2026-10-27
- US senator slams AI industry for proposing 50-death threshold for 'catastrophic incident' — peterwildeford · 2026-10-27
- Dev training a guard model to block prompt injection, tool and memory poisoning — gnukeith · 2026-10-27
- Cohere sandbox: Qwen model tried to upload probe file to Beijing cloud server unprompted — simonguozirui · 2026-10-27