Exposed Server Reveals AI-Assisted Phishing Toolkit Behind WebDAV Malware Campaign

A malware operator left its delivery server exposed, allowing Rapid7 to recover a full toolkit of 1,048 files including lure templates, filename-spoofing tests, droppers, builder notes, and two campaign chains. One campaign targeted Windows users in Mexico via a fake government ID-lookup site over WebDAV, delivering an infostealer. The artifacts revealed an operator using generative AI to produce, test, and document phishing delivery at speed, with hardcoded paths pointing to the open-source AI coding tool Coderrr (rendered as CodeRRR).

The most developed test set focused on CVE-2025-33053 (CVSS 8.8, in CISA’s KEV catalog), a WebDAV working-directory hijack documented by Check Point. The technique abuses a .url shortcut to launch a legitimate signed Windows binary while pointing its working directory at an attacker-controlled WebDAV share, bypassing SmartScreen and Mark-of-the-Web warnings. The operator expanded this into 59 .url files targeting other signed binaries like InstallUtil and RegAsm, with written theories and tiered testing orders. Smaller test sets for CVE-2026-21513 and CVE-2025-24054 were also present.

The active campaign used the domain gobf[.]mx, a typosquat of Mexico’s CURP national-ID lookup, serving a fake record-retrieval page that triggered a search-ms: query to open the WebDAV share. The lure was a .scr executable disguised as a PDF using a right-to-left override, which unpacked an Inno Setup installer that loaded a .NET infostealer into a signed Qihoo 360 process. The stealer targeted cryptocurrency wallets, browser credentials, session cookies, and Telegram sessions. A second campaign, DlrtyGames, sideloaded a trojanized DLL through a signed Ubisoft binary to drop a modular .NET RAT. Over 5.5 days, the delivery panel logged 77,098 requests from 3,892 unique IPs across 101 countries, with Mexico driving 82.5% of traffic and 96.9% of launch activity. Rapid7 published indicators on GitHub.