Exposed Server Reveals AI-Assisted Phishing Toolkit in WebDAV Malware Campaign
Open server exposes AI-powered phishing tools and WebDAV exploits in active malware operation.
1Exposed Server and Discovered Tools
A malware operator left its delivery server exposed, allowing Rapid7 to obtain the entire toolkit. Among 1,048 files were phishing templates, filename spoofing tests, execution attempts, and two active campaign chains. This dataset provides a rare glimpse into the operator's development process.
2WebDAV Exploit and Targeted Vulnerability
The operator exploits CVE-2025-33053 using a WebDAV working directory hijack technique. This method launches a signed Windows binary via .url shortcut while redirecting its working directory to an attacker-controlled WebDAV share. Microsoft patched this flaw in June 2025, but the operator is testing other signed binaries.
3AI-Assisted Operation
Rapid7 identified the operator using AI to accelerate phishing delivery. READMEs, lure generation guides, and test reports feature templated formatting and emoji-heavy structures characteristic of LLM output. The operator likely used Coderrr, an open-source AI coding assistant.
4Mexico-Focused Active Campaign
An active campaign targets Mexican users through a fake government ID lookup site delivering an infostealer. The PDF-disguised .scr file uses Inno Setup to inject a .NET infostealer into a signed process. Over 5.5 days, 77,098 requests were logged with 82.5% traffic originating from Mexico.
5Second Campaign: Game-Themed Delivery
A second campaign directory named DlrtyGames delivers a modular .NET RAT by sideloading a trojanized DLL through a signed Ubisoft binary. This approach demonstrates the operator's versatility in delivery methods.
6Defensive Measures and Implications
Rapid7 published IOCs for both campaigns. Defenders should monitor for behaviors like WebClient service initiation, davclnt.dll accessing remote hosts, and filenames using RTLO. This AI-assisted operation shows how modern threat actors operate like software product teams.