Rapid7 Finds Evidence of AI-Assisted Phishing Toolkit in WebDAV Malware Campaign
Summary
Rapid7 says an exposed server held 1,048 files documenting an apparently AI-assisted phishing toolkit and an active Mexico campaign using a fake CURP site and WebDAV delivery tied to CVE-2025-33053. Recorded launch events do not confirm infections.
Key points
- Rapid7 recovered 1,048 files, including campaign logs, test kits, lure templates, and documentation. It assesses the artifacts as evidence of an operator using generative AI to build and test phishing workflows.
- An active campaign targeted Mexican users through gobf[.]mx, a fake CURP lookup site. Its download link opened a WebDAV share, and a .scr executable used right-to-left text control to appear as a PDF.
- The lure installed a loader and an in-memory .NET infostealer that targeted cryptocurrency wallets, browser credentials, session cookies, and Telegram sessions.
- The main test set focused on the CVE-2025-33053 WebDAV working-directory hijack, which can make a signed Windows binary load an attacker-controlled executable from a remote share. Microsoft patched the flaw in June 2025.
- A 59-file test kit explored applying the technique to other signed binaries; the article says these were candidates to test, not confirmed hijacks. The original method no longer works as described on Windows 11 24H2.
- The delivery panel recorded 2,441 launch events during the campaign period. Rapid7 cautions these indicate delivery activity, not confirmed endpoint infections.
- The article recommends monitoring WebClient and davclnt.dll activity to remote hosts, signed binaries launched from WebDAV or UNC paths, and filenames using RTLO or suspicious extensions.
Article Details
- Attack Vectors
- A fake CURP lookup site targeting Mexican users used a download button to launch a search-ms query that opened the operator’s WebDAV share.
- A .url shortcut used the CVE-2025-33053 WebDAV working-directory hijack to make a signed Windows binary load an attacker-provided executable.
- A CURP-themed .scr executable was disguised as a PDF using a right-to-left override in its filename.
- An Inno Setup installer unpacked a loader that ran a .NET infostealer in memory, hollowed into a signed Qihoo 360 process.
- A separate campaign used DLL sideloading through a signed Ubisoft binary to drop a modular .NET RAT.
- Defensive Notes
- Microsoft patched CVE-2025-33053 in June 2025; the article says the original iediagcmd.exe path does not work on Windows 11 24H2.
- Monitor for the WebClient service starting and davclnt.dll connecting to a remote host, and for signed binaries spawning children from WebDAV or UNC paths.
- Watch for filenames using the RTLO character (U+202E), double extensions, or padding before .exe or .scr.
- Rapid7 published indicators for both campaigns; the article recommends blocking those indicators.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | gobf[.]mx | Typosquatted phishing domain that served a fake CURP lookup page and initiated delivery from the operator’s WebDAV share. |
MITRE ATT&CK
T1036.002 · Right-to-Left OverrideThe CURP-themed .scr executable used a right-to-left override to make its filename appear to be a PDF.T1055.012 · Process HollowingThe .NET infostealer was reportedly hollowed into a signed Qihoo 360 process.T1105 · Ingress Tool TransferThe campaign used a WebDAV share to deliver the .scr executable and related malware.T1539 · Steal Web Session CookieThe infostealer collected session cookies.T1555.003 · Credentials from Web BrowsersThe infostealer collected browser credentials.T1574.002 · DLL Side-LoadingThe DlrtyGames campaign sideloaded a trojanized DLL through a signed Ubisoft binary.T1574.008 · Path Interception by Search Order HijackingThe WebDAV shortcut hijack pointed a signed binary’s working directory at a remote share so Windows loaded the attacker’s route.exe.