Exposed Server Reveals AI-Built Phishing Toolkit Behind WebDAV Malware Campaign

A malware operator left its delivery infrastructure wide open, and Rapid7 pulled down the entire operation. The exposed server contained 1,048 files spanning lure templates, filename-spoofing tests, execution experiments, droppers, builder notes, and two full campaign chains. One chain was already live against Windows users in Mexico, distributing an infostealer through a fake government ID-lookup site served over WebDAV. Researchers rarely get this kind of complete view into a threat actor's development pipeline, with testing notes, failed experiments, documentation, and live delivery logs sitting side by side.

The centerpiece of the toolkit centered on CVE-2025-33053 (CVSS 8.8), now listed in CISA's Known Exploited Vulnerabilities catalog. This WebDAV working-directory hijack, originally documented by Check Point in its Stealth Falcon reporting, abuses a .url shortcut to launch a legitimate signed Windows binary while redirecting its working directory to an attacker-controlled WebDAV share. In the original attack, the shortcut triggered iediagcmd.exe, an Internet Explorer diagnostics tool that invokes helpers like route.exe by bare filename. With the working directory pointed at the remote share, Windows loads the attacker's route.exe from WebDAV instead of the real binary in System32. The operator's own README boasted that the technique executes "WITHOUT any security warnings. Zero alerts!" Microsoft patched the flaw in June 2025, and one preserved README mirrored Check Point's writeup closely enough to retain the original summerartcamp[.]net@ssl@443\DavWWWRoot\OSYxaOjr example path verbatim. Security teams investigating suspicious WebDAV traffic can audit their exposure with a port scanner and verify certificate handling on any WebDAV endpoints using the SSL/TLS checker.

The operator then scaled the technique into a comprehensive test kit of 59 .url files targeting other signed binaries, including .NET tools like InstallUtil and RegAsm, LOLBAS entries, and UAC-bypass candidates. Each file came with a written theory explaining why the hijack should work and a tiered testing order. The operator had a concrete reason to broaden the search: the original trick breaks on Windows 11 24H2, where Internet Explorer and therefore iediagcmd.exe no longer exist. Smaller test sets targeted the MSHTML bypass CVE-2026-21513 and the NTLM-leak CVE-2025-24054, but the WebDAV hijack remained the primary focus.

The strongest signal of AI involvement lies in the paperwork. Rapid7 noted that READMEs, lure-generation guides, matrix-style test write-ups, and a _MAPPING.csv tying each test file to its target binary carry the templated formatting, verbosity, and emoji-heavy structure commonly associated with LLM output. The phishing site's JavaScript reads the same way, and a hardcoded path in the artifacts points to an open-source AI coding tool. For defenders and end users worried about infostealer exposure, checking whether credentials appeared in the campaign's harvested data is a practical first step using an email breach checker, while organizations should audit domains associated with the operation through a WHOIS lookup to map related infrastructure.