A malware operator left its delivery server wide open, and Rapid7 pulled down the whole toolkit: 1,048 files spanning lure templates, filename-spoofing tests, execution experiments, droppers, builder notes, and two campaign chains. One was already live against Windows users in Mexico, delivering an infostealer through a fake government ID-lookup site over WebDAV.
What makes it more than a payload dump: it caught the operation mid-build. Testing notes, failed experiments, documentation, and live delivery logs sat in one place, the kind of complete development trail defenders rarely see.
Rapid7 reads the artifacts, down to a hardcoded path pointing at an open-source AI coding tool, as an operator using generative AI to produce, test, and document phishing delivery at speed.
The most developed test set focused on CVE-2025-33053 (CVSS 8.8, now in CISA's KEV catalog), the WebDAV working-directory hijack Check Point documented last year in its Stealth Falcon reporting.
The operator appeared to be reproducing it. The technique abuses a .url shortcut to launch a legitimate signed Windows binary while pointing its working directory at an attacker-controlled WebDAV share. In the original attack, the shortcut launched iediagcmd.exe, an Internet Explorer diagnostics tool that starts helpers like route.exe by bare filename; with the working directory pointed at the remote share, Windows loads the attacker's route.exe from WebDAV instead of the real one in System32.
