Exposed Server Reveals AI Phishing Toolkit After WebDAV Malware Campaign
The malware user left his delivery server open, and Rapid7 took down the entire toolkit: 1,048 files including lure templates, filename tests, execution tests, downloads, developer notes, and two campaign chains. Another has gone live against Windows users in Mexico, delivering an infostealer through a fake government ID lookup site over WebDAV.
What makes it more than just a payload dump: it holds the job in the middle of the structure. Test notes, failed tests, documentation, and live delivery logs sit in one place, the kind that defenders of a holistic development approach rarely see.
Rapid7 reads artifacts, down a hard-coded path that points to an open-source AI coding tool, as an operator that uses generative AI to generate, test, and deliver phishing attacks at speed.
The most advanced test set focuses on CVE-2025-33053 (CVSS 8.8, now in CISA’s KEV catalog), a WebDAV working-directory hijack Check Point documented last year in its Stealth Falcon report.
The user appeared to reproduce it. The process abuses a .url shortcut to boot a legally signed Windows binary while pointing its working directory to an attacker-controlled WebDAV share. In the initial attack, an interceptor was launched iediagcmd.exea diagnostic tool for Internet Explorer that starts helpers like route.exe with an empty filename; with a working directory pointed to a remote share, Windows loads the attacker’s route.exe from WebDAV instead of the original in System32.
The user’s own README says this works without SmartScreen or the Mark-of-the-Web warning, “WITHOUT any security warnings. Empty warnings!” Microsoft closed the bug in June 2025.
The notes mirror the Check Point script closely enough that the README finds are kept accurate summerartcamp[.]net@ssl@443DavWWWRootOSYxaOjr for example the path from the first report. The operator then weighed the test.
One “extensive test kit” extended one method to 59 .url files directed to other signed binaries: .NET tools like InstallUtil again RegAsmLOLBAS entries, even UAC-bypass candidates, each have a written opinion on why the hacker should work and a step-by-step test order.
The notes take these as candidates to investigate the criminals one by one, unconfirmed, and the operator built a set for a concrete reason: the first strategy explodes Windows 11 24H2, where Internet Explorer, etc. iediagcmd.exehe is no more. The directory also hosted subsets of checks for two other file handling errors, MSHTML bypass CVE-2026-21513 and NTLM leaks CVE-2025-24054but the WebDAV hack was the main event.
The story is in the papers. Rapid7 features READMEs, thread generation guides, matrix-style test writing, and _MAPPING.csv compiling each test file into its target binary handles the template formatting, verbosity, and heavy emoji structure associated with LLM output.
It reads the site’s emoji-filled JavaScript in the same way. Russian comments and folder names, one called testik (abbreviated “test”), put the operator in the Russian-speaking context but do not specify them. Rapid7 includes LLM-assisted functionality and workflow, likely built with help from Coderrr, which stands for “CodeRRR.”
Hacker News confirmed that the repository is public as of July 20, 2026: a general-purpose, open-source AI code agent inspired by Claude Code, the GitHub Copilot CLI, and Cursor, not a tool aimed at an attacker. Rapid7’s summary does not hide: “the attacker used LLMs to act as a modern software product group.”
The user even left the delivery panel, an administrator tool called Simba Service, sitting on the same server with its default port and credentials unchanged.
Active campaign targeting Mexican users
MDR alert tracked back gobf[.]mxtyposquat of the federal CURP national ID lookup, which provided victims with a fake records retrieval page with its opt-out button search-ms: the question. That opened the operator’s WebDAV share as a Windows Explorer search filtered to it .scr files.
The main attraction that was delivered looked like a CURP PDF report but it was .scr executable, its file name is overwritten from right to left to be read as a PDF. It was the Inno Setup installer that unloaded and ran the .NET infostealer completely in memory, which entered the Qihoo 360 signed process.
The hacker stole cryptocurrency wallets, browser credentials, session cookies, and Telegram sessions. The second indicator of the campaign, DlrtyGamestook a different route, sideloading a trojanized DLL with a signed Ubisoft binary to bring down the modular .NET RAT.
In about 5.5 days (June 20 to 26, 2026 UTC), the delivery panel fielded 77,098 requests from 3,892 unique IPs in 101 countries, with Mexico alone driving 82.5% of the traffic and 96.9% of the activations. A single CURP attraction accounted for 2,384 of the 2,441 launch events, about 97.7%.
That figure measures the arrival of a delivery, not an infection: Rapid7 counts a “launch event” when the panel sees a client request or opens an achievement in the assignment, not a confirmed run at the end, and traffic from the US and Germany looked more like scans than victims. Work has also been integrated into Mexico’s working hours, in line with real users rather than automated scanners.
For defenders, the June 2025 patch closed the original iediagcmd.exe method, but the 59-file kit shows the operator hunting for other signed binaries that behave similarly. Rapid7 has published the indexes of both campaigns, including C2 addresses and file hashes, on its GitHub; block those first.
For those that miss IOCs, watch the behavior caught by the warning first: the WebClient service that starts again davclnt.dll accesses a remote host, a signed binary child whose image path resides on a WebDAV or UNC share, and filenames using RTLO (U+202E), double extensions, or prefixes .exe or .scr.
Hacker News has reached out to Rapid7 for clarification on the identification of the final payload and the current state of the exposed infrastructure, and will update this story with any response.
The delivery explosion was short-lived, cooling off after June 24. What’s permanent is the way: the operator wired AI coding tools, never designed for the job, into a repeatable pipeline for generating and testing phishing deliveries, ready to target the next target.
