Symantec: AI helped attackers revive a stalled break-in at a US retailer

Symantec’s Threat Hunter Team published a detailed account on November 12, 2026 of an intrusion at an unnamed US retail organisation in September. Its report shows attackers who were getting nowhere by hand, then came back the next day with what look like AI-generated commands and broke through within minutes. Dark Reading also covered it. It’s one of dozens of AI-assisted attacks Symantec says it has investigated since May, most of them in September. Here’s what the evidence shows and what it doesn’t.

What happened

• September 18: the first malicious activity, on three Microsoft SQL Server machines, most likely through the database’s xp_cmdshell feature. Scripts searched point-of-sale sync folders for stored passwords and built a privilege escalation tool on one server.
• September 21 and 22: the attackers worked on an internet-facing web server by hand. Symantec counted three typing errors in 110 actions, such as “pwoershell”. Every payload they staged was stopped by security software. They re-ran one blocked loader about five times in 20 minutes without changing their approach.
• September 23: the commands changed. For almost two hours the attackers sent around 50 long PowerShell scripts with no typos, labelled sections such as ===FILES MENTIONING CONN STRINGS===, error handling and capped output. They collected credentials from the server, found the SolarWinds Orion monitoring software, read the shared secret of the RabbitMQ message broker bundled with it, and used Orion’s own erl.exe to run commands on a second server. That took about 10 minutes from their first Orion query.
• September 24 to 29: more servers were touched, including what appears to be a domain controller. The attackers saved registry hives that hold password hashes, searched for the Active Directory database, and ran a password sprayer.

Why Symantec thinks AI was involved

The strongest clue is in the comments. Several scripts opened with text that stated a hypothesis, cited earlier results and revised a previous conclusion, the way a chat assistant explains itself. One noted that earlier negative results came from a proxy channel known to report false successes, so the test had to be redone from a different host. Symantec says human operators don’t usually write that kind of reasoning into a one-off web shell command.

Symantec rates its conclusion that AI assisted the attack at high confidence. It rates its view that a person was copying output into an AI tool and pasting back the reply, rather than an autonomous agent running on its own, at moderate confidence, based on gaps of at least seven seconds between scripts and longer pauses before changes of strategy. It couldn’t identify the AI model or service.

What it does not show

• No new technique. Symantec stresses that every step, from reading Erlang cookies to dumping registry hives, has been documented for years. What AI appears to have changed is how quickly and reliably the attackers applied them.
• Who it was. The loaders and staging server overlap with an August intrusion elsewhere and a July intrusion at a securities firm, neither with signs of AI. The side-loading pair the attackers used has been tied to ShadowPad loaders, and a tunnelling tool seen in August has been used by Warlock ransomware attackers. Symantec says neither is enough on its own to name a group.
• What was taken. Symantec saw no data theft or encryption. It thinks the attackers were most likely after money, because they searched point-of-sale scripts for passwords and contacted an address that a separate report linked to an operation stealing card data from online retailers.
• How they got in. The initial entry point is unknown.

The wider pattern

Symantec outlines other AI-assisted cases from June to September, including a university web server in Vietnam, a technology provider for East African banks and telecoms, and a hydroelectric company in South Asia. One AI-written script still contained the placeholder YOUR_IP where an attacker’s address should have gone. Across the cases, it says, AI added speed and persistence: attackers renamed or rebuilt blocked tools within seconds or minutes.

What this means for you

For people, nothing here changes the basics: retailers that hold your card and loyalty data are worth attacking, and the defence is on their side. For security teams, Symantec’s advice is practical. A blocked attempt followed quickly by a variant is itself a warning sign worth treating as high priority, and blocking on behaviour matters more than matching file names or exact commands. It also suggests measuring how fast you can mitigate, not just how fast you can patch.

What you can do

If you defend Windows servers:

1. Turn off xp_cmdshell on SQL Server unless you truly need it.
2. Keep passwords out of scripts and config files, including point-of-sale sync scripts and monitoring tools.
3. Protect monitoring software like SolarWinds Orion, which holds secrets and can reach many other servers.
4. Alert on a block followed by a quick retry or variant from the same host.

How Frame helps

This report is about a company intrusion, not a list of personal email addresses, so there isn’t a breach record to add in Frame. Frame can also look up your verified emails in Have I Been Pwned’s breach database for other breaches.

Related coverage

• Kaspersky describes Citrus, a ransomware group that gets in through contractors and uses AI-written commands: another report this week of attackers using AI-generated scripts mid-attack.
• Attackers used AntiFox, an open-source AI hacking agent, to reach AWS production secrets: the more automated end of the same trend.

Sources

• Symantec Threat Hunter Team, How AI Revived a Stalled Attack on a U.S. Retailer, November 12, 2026
• Dark Reading, Inside an AI Attack Against a US Retailer, November 12, 2026