• Public

  • Public
  • Network
  • Groups
  • Featured
  • Popular
  • People

Interestingly, when we analyzed the VBScript and the JavaScript, we were surprised to find that the code was not obfuscated. In fact, the attacker had left comments throughout the code, describing what each line does even for simple functions. Genuine code comments in malware are rare because attackers want to their make malware as difficult to understand as possible. Based on the scripts’ structure, consistent comments for each function and the choice of function names and variables, we think it’s highly likely that the attacker used GenAI to develop these scripts (T1588.007). The activity shows how GenAI is accelerating attacks and lowering the bar for cybercriminals to infect endpoints.