Exposed Server Reveals AI-Assisted Phishing Toolkit Behind WebDAV Malware Campaign
19:29 · July 20, 2026 · Hacker News AI Section
A malware operator left its delivery server wide open, and Rapid7 pulled down the whole toolkit: 1,048 files spanning lure templates, filename-spoofing tests, execution experiments, droppers, builder notes, and two campaign chains. One was already live against Windows users in Mexico, delivering an infostealer through a fake government ID-lookup site over WebDAV. What makes it more than a
Summary
An exposed server belonging to a malware operator yielded a complete 1,048-file toolkit that Rapid7 recovered in full. The contents included lure templates, filename-spoofing experiments, execution tests, droppers, builder notes, and two active campaign directories. One campaign was already operational, using a typosquatted Mexican government site to deliver an infostealer through WebDAV shares to Windows endpoints.
The artifacts revealed an operator actively developing and refining delivery methods rather than simply reusing existing tools. README files, test matrices, and documentation exhibited the structured, verbose, and emoji-laden formatting typical of large-language-model output. Rapid7 traced hardcoded paths to an open-source AI coding agent, indicating that the operator relied on commodity generative tools to generate, test, and document phishing infrastructure at scale.
The primary technique under development centered on CVE-2025-33053, a WebDAV working-directory hijack. The method uses a .url shortcut to launch a legitimate signed binary while redirecting its working directory to an attacker-controlled share, causing Windows to load a malicious executable in place of a system binary. The operator expanded a single proof-of-concept into a 59-file test suite targeting additional signed binaries and LOLBAS entries, explicitly adapting the approach after the original iediagcmd.exe vector became unavailable on Windows 11 24H2.
Live operations included a campaign spoofing Mexico’s CURP national-ID portal. Victims received a .scr executable disguised through right-to-left override characters; the file installed an in-memory .NET infostealer that harvested wallets, credentials, and session data. A second directory, DlrtyGames, tested DLL sideloading via a signed Ubisoft binary to deploy a modular RAT. Over five and a half days the delivery panel recorded roughly 77,000 requests from nearly 4,000 IPs, with the majority originating in Mexico during local working hours.
Rapid7 published indicators of compromise and behavioral detections, such as WebClient service activity reaching remote shares and child processes launched from UNC paths. The June 2025 patch addressed the original iediagcmd.exe vector, yet the test kit demonstrates continued exploration of alternative signed binaries. The episode illustrates how readily available AI coding assistants can accelerate the full cycle of malware delivery development, from initial research to operational deployment.
Why it matters
Directly addresses AI misuse for generating phishing and malware at scale, offering actionable IOCs and detection guidance for security teams. Highlights emerging LLM-driven attack workflows relevant to EU threat landscapes and compliance needs.
