Threat
Inside an AI Attack Against a US Retailer
First reported darkreading.com
Page published
Earliest dated coverage: 12 Nov 2026 · First observed: 12 Nov 2026 · Latest dated coverage: 12 Nov 2026
Coverage timeline
Single-source incident — one report is available.
Why it matters
The reported retailer intrusion highlights how human-operated LLM assistance may accelerate credential theft and lateral movement even when initial manual commands are blocked.
Symantec reported that an attacker targeting an unnamed US retailer switched from blocked hand-typed commands to suspected AI-generated scripts, then harvested credentials and achieved lateral movement within minutes. Investigators inferred AI assistance from command timing and assessed that a human was relaying outputs rather than an autonomous agent conducting the attack.