Talos recently spotted a targeted phishing attack with several unique characteristics that are not normally seen. The attack was more difficult to detect because adversaries chose to leverage AutoIT, a well known freeware administration tool for automating system management in corporate environments. The use of AutoIT is potentially an extremely effective method of evading detection by traditional anti-virus technologies and remaining hidden on the system if it is used by the target to manage systems. The combination of a legitimate administration tool being used to install a back-door onto a target system is unique.”]
Source: https://blog.talosintelligence.com/2015/08/malware-meets-sysadmin-automation-tools.html