Huntress Finds AI-Assisted Scripts and a Browser RAT Reusing Familiar Attack Techniques

Jan 12, 2026 · Original article ↗

Summary

Huntress describes four cases where attackers used apparently AI-assisted scripts and a malicious Chrome extension for credential theft and data collection, concluding AI sped up familiar tradecraft rather than creating fundamentally new attack methods.

Key points

In one case, an intruder brute-forced RDP access and ran a suspicious PowerShell credential dumper; Huntress says it contained the session and removed the actor.
A separate Veeam credential-theft script, deployed after network enumeration and lateral movement via WinRM, failed to execute.
In another case, a rogue ScreenConnect session delivered a PowerShell script that scanned Chrome and Edge history for Chase banking URLs and sent collected data to a Telegram endpoint.
The same actor’s earlier scripts targeting QuickBooks and Coinbase had apparent functionality errors; a later script targeting Chase worked.
Huntress analyzed a malicious Chrome extension posing as a Telegram-related tool. It supported cookie export, browsing-history collection, screenshots, and file collection, and contacted 172.86.105[.]237:5000 for tasking.
The authors say AI-assisted activity in these cases accelerated familiar techniques, while emphasizing telemetry, MFA, segmentation, least privilege, and monitoring of scripting and lateral movement.

Article Details

Attack Vectors: Brute-force access to RDP followed by PowerShell-based credential access.
Network enumeration and lateral movement via WinRM, followed by an attempted PowerShell script targeting Veeam credentials.
A rogue ScreenConnect session delivered a PowerShell payload that scanned Chrome and Edge history for banking URLs and sent collected data to a Telegram endpoint.
A malicious Chrome extension masquerading as a Telegram-related tool beaconed to a C2 server and supported cookie theft, browsing-history collection, screenshots, and file exfiltration.
Defensive Notes: Retain telemetry and use end-to-end EDR and SOC playbooks.
Enforce multifactor authentication for VPNs, administrative interfaces, RMM, and backup consoles.
Restrict lateral movement through network segmentation and least privilege; monitor WinRM, RDP, and service-account usage.
Log and alert on suspicious interpreter activity, capture command lines, and enable script-block logging.
Maintain detections for anomalous enumeration, lateral movement, credential dumping, and privilege escalation.

Indicators of compromise

Type	Indicator	Context
SHA256	`19d19ac8199298f7b623693f4e38cb79aba8294c258746a3c9d9a183b2bb2578`	Hash listed for secure.chase.ps1, a script that scanned browser history for Chase URLs and exfiltrated collected data.
SHA256	`4574ffef886ca461a89db7b9aaaede2e20ac802a82db94e3b6e4d0e86370e7a4`	Hash listed for C:\temp\v.ps1, an attempted PowerShell payload targeting Veeam credentials.
SHA256	`57f2a2bb77f5400b46ebc42118f46ffaa497d5c03c24d1cb3868dde2381a0f07`	Hash listed for qb_check.ps1, a script deployed to target QuickBooks credentials.
SHA256	`cf289b3ab970a3d04213b7312220f769f493f2f2c666ed7a8fe512075a84e995`	Hash listed for coinbase_check.ps1, a script that reported Coinbase results but retained logic searching for QuickBooks data.
SHA256	`d272c90fc264fa3e4a71fbeff324273c99dd0a48fd2f0234aa6fdd3e80add936`	Hash listed for background.js, a component of the malicious Chrome extension functioning as a browser RAT.
SHA256	`f75219e2aea50b8fa618f55389ab9a58351fb6acd4ea7c7de3e656183d5a52f0`	Hash listed for popup.html, part of the malicious Chrome extension's attacker-facing interface.