Researchers at Rapid7 discovered an unsecured malware delivery server containing 1,048 files — ranging from phishing lure templates and filename spoofing tests to droppers, developer notes, and two fully developed attack chains. One of the campaigns was already active and targeting Windows users in Mexico: via a fake national CURP ID verification site, victims were delivered an infostealer over the WebDAV protocol. The find is unique in that the researchers gained access not to a single payload, but to the entire development lifecycle — with test notes, failed experiments, and delivery logs, which makes it possible to study the attacker’s methodology in detail. Organizations working with Mexican users or running Windows without the June 2025 patch should immediately check the indicators of compromise published by Rapid7 on GitHub.
Core of the operation: reproducing CVE-2025-33053
The central element of the discovered toolkit was a set of tests aimed at reproducing the CVE-2025-33053 vulnerability (CVSS 8.8). This vulnerability, first documented by Check Point in the context of the Stealth Falcon group, allows a .url file to launch a legitimate signed Windows executable while redirecting its working directory to an attacker-controlled WebDAV resource.
In the original attack, the shortcut launched iediagcmd.exe — an Internet Explorer diagnostic utility that invokes helper programs (such as route.exe) by name without specifying the full path. Since the working directory pointed to a remote resource, Windows loaded a malicious replacement route.exe from the WebDAV share instead of the legitimate file from System32. According to Rapid7, the operator’s documentation explicitly claimed that the technique worked without SmartScreen and Mark-of-the-Web warnings. Microsoft closed the vulnerability with a patch in June 2025.
Notably, one of the recovered README files contained the exact path example summerartcamp[.]net@ssl@443\DavWWWRoot\OSYxaOjr from the original Check Point report — the operator clearly used the public research as a starting point.
Scaling up: 59 substitution candidates
Since the original vector via iediagcmd.exe does not work on Windows 11 24H2 (Internet Explorer and its components are absent there), the operator, according to Rapid7, created a “comprehensive test suite” of 59 .url files targeting other signed Windows executables. Candidates included .NET tools (InstallUtil, RegAsm), entries from the LOLBAS catalog, and potential UAC bypass candidates. Each test was accompanied by a description of the theory for why the substitution should work and a priority for testing.
Important caveat: Rapid7 stresses that these are candidates for testing, not confirmed working substitution techniques. In addition to the main set, the directory contained smaller test sets for two other vulnerabilities — CVE-2026-21513 (MSHTML bypass) and CVE-2025-24054 (NTLM leak) — but the primary focus was on the WebDAV-based substitution.
The role of generative AI in the operation
In the assessment of Rapid7, the artifacts found indicate the operator’s active use of generative AI to create, test, and document phishing delivery chains. README files, lure-generation guides, matrix-style test descriptions, and the _MAPPING.csv file linking each test file to its target binary all showed traits characteristic of LLM output: templated formatting, excessive detail, and abundant emojis. Researchers found similar signs in the phishing site’s JavaScript code.
Rapid7 linked the operator’s workflow to the open-source tool Coderrr — a general-purpose AI-based coding agent inspired by Claude Code and GitHub Copilot CLI. This is a standard developer tool, not designed for attacks. Rapid7’s conclusion is succinct: “the attacker used an LLM to work like a modern product team.”
It should be noted that attributing the use of AI is based on stylistic analysis of artifacts and has not been confirmed by independent sources.
Active campaign against users in Mexico
A Rapid7 MDR signal led to the domain gobf[.]mx — a typosquat of the official CURP national ID verification service. The fake page contained a download button that initiated a search-ms: request, opening the attacker’s WebDAV resource in Windows Explorer filtered for .scr files.
The main lure looked like a CURP PDF report but was in fact an .scr executable whose name was spoofed using the Unicode Right-to-Left Override character (U+202E). The file was an Inno Setup installer that unpacked a loader and ran a .NET infostealer entirely in memory, injecting it into a signed Qihoo 360 process (process hollowing). According to Rapid7, the stealer collected cryptocurrency wallets, browser credentials, session cookies, and Telegram sessions.
The second campaign directory, DlrtyGames, used a different approach: a signed Ubisoft binary loaded a trojanized DLL (sideloading), which installed a modular .NET RAT.
Delivery scale
For the period from June 20 to 26, 2026, the delivery panel (Simba Service) logged 77,098 requests from 3,892 unique IP addresses across 101 countries. Mexico accounted for 82.5% of traffic and 96.9% of launch events. A single CURP lure generated 2,384 of 2,441 launch events (97.7%).
It is critical to understand: a “launch event” in Rapid7’s terminology is a client request or opening of an executable from the resource recorded by the panel, not a confirmed endpoint compromise. In the researchers’ assessment, traffic from the US and Germany looked more like scanning than real victims. Activity was concentrated during working hours in the Mexican time zone, indicating real users.
The Simba Service control panel was located on the same server, with the default port and default credentials.
Recommendations for defenders
The June 2025 patch closed the original vector via iediagcmd.exe, but the set of 59 files shows that the operator is deliberately searching for other signed binaries with similar behavior. Priority actions:
- Block the indicators of compromise — C2 addresses and file hashes from the Rapid7 repository, including the
gobf[.]mxdomain. - Ensure the patch is installed for CVE-2025-33053 on all Windows systems.
- Monitor behavioral indicators: the WebClient service starting and
davclnt.dllconnecting to remote hosts; signed binaries spawning child processes whose image path is on a WebDAV or UNC resource; filenames containing the RTLO character (U+202E), double extensions, or padding before.exe/.scr. - Restrict the WebDAV protocol at the network and endpoint level if it is not required for business processes.
- Block handling of the
search-ms:URI scheme via Group Policy if it is not used.
The delivery spike was short-lived — activity declined after June 24. However, the main takeaway from this incident is not the specific campaign but the demonstrated method: the operator integrated ordinary AI coding tools into a reproducible pipeline for creating and testing phishing delivery chains. The set of 59 candidates for substituting signed binaries is a ready-made plan for adapting to the next Windows version or the next patch. Organizations should focus not only on blocking the published IOCs, but also on detecting the pattern itself: launching a signed binary with its working directory on a remote resource is a signal that should trigger an alert regardless of the specific executable involved.
