A malware operator left its supply server huge open, and Rapid7 pulled down the entire toolkit: 1,048 information spanning lure templates, filename-spoofing assessments, execution experiments, droppers, builder notes, and two marketing campaign chains. One was already stay in opposition to Home windows customers in Mexico, delivering an infostealer by way of a faux authorities ID-lookup web site over WebDAV.
What makes it greater than a payload dump: it caught the operation mid-build. Testing notes, failed experiments, documentation, and stay supply logs sat in a single place, the sort of full improvement path defenders hardly ever see.
Rapid7 reads the artifacts, all the way down to a hardcoded path pointing at an open-source AI coding instrument, as an operator utilizing generative AI to supply, check, and doc phishing supply at pace.
Probably the most developed check set centered on CVE-2025-33053 (CVSS 8.8, now in CISA’s KEV catalog), the WebDAV working-directory hijack Verify Level documented final yr in its Stealth Falcon reporting.
The operator gave the impression to be reproducing it. The method abuses a .url shortcut to launch a authentic signed Home windows binary whereas pointing its working listing at an attacker-controlled WebDAV share. Within the authentic assault, the shortcut launched iediagcmd.exe, an Web Explorer diagnostics instrument that begins helpers like route.exe by naked filename; with the working listing pointed on the distant share, Home windows masses the attacker’s route.exe from WebDAV as an alternative of the true one in System32.
The operator’s personal README claims this runs with no SmartScreen or Mark-of-the-Internet warning, “WITHOUT any safety warnings. Zero alerts!” Microsoft patched the flaw in June 2025.
The notes mirror Verify Level’s writeup carefully sufficient that one recovered README preserved the precise summerartcamp[.]web@ssl@443DavWWWRootOSYxaOjr instance path from the unique report. Then the operator scaled the testing.
One “complete check package” expanded the only method into 59 .url information geared toward different signed binaries: .NET instruments like InstallUtil and RegAsm, LOLBAS entries, even UAC-bypass candidates, every with a written concept of why the hijack ought to work and a tiered testing order.
The notes deal with these as candidates to probe one after the other, not confirmed hijacks, and the operator constructed the set for a concrete purpose: the unique trick breaks on Home windows 11 24H2, the place Web Explorer, and so iediagcmd.exe, is gone. The listing additionally held smaller check units for 2 different file-handling flaws, the MSHTML bypass CVE-2026-21513 and the NTLM-leak CVE-2025-24054, however the WebDAV hijack was the principle occasion.
The inform is within the paperwork. Rapid7 says the READMEs, lure-generation guides, matrix-style check write-ups, and a _MAPPING.csv tying every check file to its goal binary carry the templated formatting, verbosity, and emoji-heavy construction it associates with LLM output.
It reads the phishing web site’s emoji-laden JavaScript the identical manner. The Russian feedback and folder names, one referred to as testik (a diminutive of “check”), place the operator in a Russian-speaking context however do not establish them. Rapid7 attributes the operation to an LLM-assisted workflow, seemingly constructed with assist from Coderrr, which it renders “CodeRRR.”
The Hacker Information confirmed the repository is public as of July 20, 2026: a general-purpose, open-source AI coding agent impressed by Claude Code, GitHub Copilot CLI, and Cursor, not attacker-specific tooling. Rapid7’s abstract is blunt: “the attacker used LLMs to function extra like a contemporary software program product workforce.”
The operator even left the supply panel, an admin instrument referred to as Simba Service, sitting on the identical server with its default port and credentials unchanged.
An energetic marketing campaign concentrating on Mexican customers
The MDR alert traced again to gobf[.]mx, a typosquat of the federal government’s CURP national-ID lookup, which served victims a faux record-retrieval web page whose obtain button fired a search-ms: question. That opened the operator’s WebDAV share as a Home windows Explorer search filtered to .scr information.
Probably the most-delivered lure regarded like a CURP PDF report however was a .scr executable, its filename flipped with a right-to-left override to learn as a PDF. It was an Inno Setup installer that unpacked a loader and ran a .NET infostealer totally in reminiscence, hollowed right into a signed Qihoo 360 course of.
The stealer grabbed cryptocurrency wallets, browser credentials, session cookies, and Telegram periods. A second marketing campaign listing, DlrtyGames, took a unique route, sideloading a trojanized DLL by way of a signed Ubisoft binary to drop a modular .NET RAT.
Over roughly 5.5 days (June 20 to 26, 2026 UTC), the supply panel logged 77,098 requests from 3,892 distinctive IPs throughout 101 nations, with Mexico alone driving 82.5% of visitors and 96.9% of launch exercise. A single CURP lure accounted for two,384 of the two,441 launch occasions, about 97.7%.
That determine measures supply attain, not infections: Rapid7 counts a “launch occasion” when the panel sees a shopper request or opens an executable from the share, not a confirmed run on an endpoint, and the visitors from the US and Germany regarded extra like scanning than victims. The exercise additionally clustered in Mexican working hours, per actual customers slightly than automated scanners.
For defenders, the June 2025 patch closed the unique iediagcmd.exe path, however the 59-file package exhibits the operator looking different signed binaries that behave the identical manner. Rapid7 has revealed indicators for each campaigns, together with C2 addresses and file hashes, on its GitHub; block these first.
For what the IOCs miss, watch the conduct the alert first caught: the WebClient service beginning and davclnt.dll reaching a distant host, a signed binary spawning a toddler whose picture path sits on a WebDAV or UNC share, and filenames utilizing RTLO (U+202E), double extensions, or padding earlier than .exe or .scr.
The Hacker Information has reached out to Rapid7 for clarification on the ultimate payload identification and the present standing of the uncovered infrastructure, and can replace this story with any response.
The supply burst was short-lived, cooling after June 24. What lasts is the strategy: an operator wired commodity AI coding instruments, by no means constructed for the job, right into a repeatable pipeline for producing and testing phishing supply, able to level on the subsequent goal.
