Exposed Server Reveals AI-Assisted Phishing Toolkit Behind WebDAV Malware Campaign

Summary: Rapid7 recovered 1,048 files from an exposed malware delivery server, including lure templates, droppers, builder notes, and two campaign chains, one of which was live against Windows users in Mexico delivering an infostealer through a fake CURP government ID-lookup site over WebDAV. The most developed test kit expanded the CVE-2025-33053 WebDAV working-directory hijack into 59 .url files targeting other signed binaries, and Rapid7 attributes the templated READMEs, test write-ups, and emoji-heavy formatting to an LLM-assisted workflow likely built with the open-source AI coding agent Coderrr.
What you should know: Over roughly 5.5 days in June 2026, the operator's Simba Service panel logged 77,098 requests from 3,892 unique IPs across 101 countries, with Mexico driving 82.5% of traffic and a single CURP lure accounting for 2,384 of 2,441 launch events - and Rapid7 has no visibility into actual infections, so the real compromise count is unknown.

Read the original at The Hacker News ↗

Topics: Malware
Mentions: CVE-2025-24054 CVE-2025-33053 CVE-2026-21513
Related: Weekly Recap: Outlook Add-Ins Hijack, 0-Day Patches, Wormable Botnet & AI Malware Cyber Risks ·
CVE-2026-21513: Microsoft MSHTML Framework Protection Mechanism Failure Vulnerability Known Exploited Vulnerabilities · Feb 10, 2026
CVE-2025-33053: Microsoft Windows External Control of File Name or Path Vulnerability Known Exploited Vulnerabilities · Jun 10, 2025