Exposed Server Reveals AI-Assisted Phishing Toolkit Behind WebDAV Malware Campaign
Rapid7 uncovered an exposed server containing a comprehensive AI-assisted phishing toolkit, revealing how threat actors use generative AI to streamline malware development and documentation. The campaign targeted Windows users in Mexico via a fake government ID website, leveraging CVE-2025-33053 (WebDAV working-directory hijack) to deliver infostealers without triggering security warnings. Analysis of the operator's files indicates the use of the open-source AI coding agent "CodeRRR," resulting
Analysis
TL;DR
- Rapid7 uncovered an exposed server containing a comprehensive AI-assisted phishing toolkit, revealing how threat actors use generative AI to streamline malware development and documentation.
- The campaign targeted Windows users in Mexico via a fake government ID website, leveraging CVE-2025-33053 (WebDAV working-directory hijack) to deliver infostealers without triggering security warnings.
- Analysis of the operator's files indicates the use of the open-source AI coding agent "CodeRRR," resulting in highly structured, LLM-generated documentation and testing matrices.
- The attack chain involved filename spoofing using Right-to-Left Override (RTLO), in-memory execution, and process hollowing into signed binaries to evade detection.
- Defenders are advised to monitor for specific behavioral indicators such as WebClient service usage, davclnt.dll connections, and suspicious spawning of child processes from WebDAV/UNC paths.
Why It Matters
This incident highlights a significant shift in cybercriminal operations, where attackers are adopting professional software development workflows powered by Large Language Models (LLMs). This allows them to rapidly prototype, test, and document exploits at a scale previously reserved for state-sponsored groups or sophisticated ransomware syndicates. For security teams, understanding these AI-driven patterns is crucial for detecting modern phishing kits that rely on automation and structured testing methodologies rather than ad-hoc scripting.
Technical Details
- AI Integration: The operator utilized "CodeRRR," an open-source AI coding agent, evidenced by hardcoded paths in the source code and the templated, emoji-heavy structure of README files and test logs, which Rapid7 identified as characteristic of LLM output.
- Exploitation Technique: The primary vector exploited CVE-2025-33053, a WebDAV working-directory hijack. Attackers used
.urlshortcuts to launch legitimate signed binaries (likeiediagcmd.exe) while redirecting their working directory to an attacker-controlled WebDAV share, causing the system to load malicious DLLs or executables from the remote share instead ofSystem32. - Delivery Mechanism: A typosquatted domain (
gobf.mx) mimicked a Mexican government ID lookup site. Clicking the download button triggered asearch-ms:query that opened a WebDAV share filtered for.scrfiles. The file appeared as a PDF due to Right-to-Left Override (RTLO) character manipulation in the filename. - Malware Execution: The delivered
.scrfile was an Inno Setup installer that unpacked a loader and executed a .NET infostealer entirely in memory. The infostealer hollowed itself into a signed Qihoo 360 process to hide its presence and exfiltrated cryptocurrency wallets, browser credentials, and Telegram sessions. - Scope and Scale: The exposed server contained 1,048 files, including 59
.urltest files targeting various signed binaries (LOLBAS, .NET tools) to expand the exploit beyond the initial IE-specific method. Traffic logs showed nearly 78,000 requests over 5.5 days, with 82.5% originating from Mexico.
Industry Insight
- Adoption of DevOps in Cybercrime: Threat actors are increasingly treating malware development like software engineering projects, using AI agents for code generation, testing, and documentation. Security solutions must evolve to detect these structured, automated development trails rather than just static malicious payloads.
- Behavioral Detection Over Signatures: Since the attacks leverage signed binaries and legitimate Windows features (WebDAV, URL shortcuts), signature-based detection will fail. Organizations must implement endpoint detection and response (EDR) policies that monitor for anomalous behaviors, such as the WebClient service initiating connections to unknown remote hosts or unexpected child process spawning from network shares.
- Patch Management and Configuration Hygiene: The ease with which the attacker operated suggests poor server hygiene (exposed ports, default credentials). While patches for vulnerabilities like CVE-2025-33053 are critical, organizations must also rigorously audit their exposure to WebDAV services and ensure that administrative interfaces are not left accessible on public-facing servers.
Disclaimer: The above content is generated by AI and is for reference only.