Exposed Server Reveals AI-Assisted Phishing Toolkit Behind WebDAV Malware Campaign
A cybercriminal, utilizing AI coding tools and a sophisticated pipeline, exposed a comprehensive phishing toolkit targeting Mexican users and beyond. The operator, likely leveraging LLMs and tools like Coderrr, created a 59-file kit designed to exploit vulnerabilities in signed binaries, including a WebDAV hijacking technique that bypassed security warnings. The campaign, active from June 20 to 26, 2026 UTC, delivered a modular .NET RAT and an infostealer, and the exposed infrastructure remains active, offering a valuable insight into how attackers are integrating AI into their operations.
A cybercriminal, utilizing AI coding tools and a sophisticated pipeline, exposed a comprehensive phishing toolkit targeting Mexican users and beyond. The operator, likely leveraging LLMs and tools like Coderrr, created a 59-file kit designed to exploit vulnerabilities in signed binaries, including a WebDAV hijacking technique that bypassed security warnings. The campaign, active from June 20 to 26, 2026 UTC, delivered a modular .NET RAT and an infostealer, and the exposed infrastructure remains active, offering a valuable insight into how attackers are integrating AI into their operations.
Rapid7 discovered a public repository containing a vast collection of files – 1,048 in total – designed to facilitate phishing attacks. These files included lure templates, filename-spoofing tests, execution experiments, droppers, builder notes, and two campaign chains. One campaign was already live against Windows users in Mexico, delivering an infostealer through a fake government ID-lookup site over WebDAV.
The operator’s methodology centered around using generative AI to produce, test, and document phishing delivery at speed. The toolkit exploited a vulnerability in Internet Explorer (CVE-2025-33053, CVSS 8.8, now in CISA's KEV catalog) and another, MSHTML bypass CVE-2026-21513, by leveraging a WebDAV share to execute malicious code. The original attack used a .url shortcut to launch iediagcmd.exe, an Internet Explorer diagnostics tool, which then spawned a route.exe from the attacker’s WebDAV share, bypassing Windows’ security measures.
The repository contained a detailed README with templated formatting, emoji-heavy structure, and Russian comments, reflecting the operator’s likely Russian-speaking background. The operator’s workflow mirrored a modern software development team, utilizing AI coding tools to automate the entire process. The delivery panel, a tool called Simba Service, was left on the server with default credentials.
An active campaign targeting Mexican users delivered a CURP PDF lure that was actually a .scr executable, designed to trick users into downloading a malicious installer. The campaign resulted in 77,098 requests from 3,892 unique IPs across 101 countries, with Mexico accounting for 82.5% of traffic and 96.9% of launch activity. The activity peaked during Mexican working hours, suggesting genuine user engagement rather than automated scanning.
Rapid7 has published indicators of compromise (IOCs) on GitHub, including C2 addresses and file hashes, to help defenders mitigate the threat. They also recommend monitoring for specific behaviors, such as the WebClient service starting and davclnt.dll reaching a remote host, a signed binary spawning a child whose image path sits on a WebDAV or UNC share, and filenames using RTLO (U+202E), double extensions, or padding before .exe or .scr. The exposure of this AI-assisted phishing toolkit highlights the evolving tactics of cybercriminals and the increasing use of AI in malicious operations.