A recent investigation by Rapid7 has revealed a significant cybersecurity threat involving an AI-assisted phishing toolkit. The exposed server, left unsecured by a malware operator, contained over 1,000 files detailing phishing tactics aimed at Windows users in Mexico. These files included template lures, test results, and execution logs, offering a rare glimpse into the development process of such malicious campaigns.
Mid-Build Operation Insights
The discovery was particularly notable as it captured the operation in its formative stages, with documentation and logs providing a comprehensive trail of the toolkit’s development. Rapid7 identified the use of generative AI to expedite the creation, testing, and documentation of phishing tactics, indicating a sophisticated approach to cybercrime.
A focus of the toolkit was on exploiting CVE-2025-33053, a WebDAV vulnerability that allows attackers to hijack working directories. This flaw was previously documented by Check Point and patched by Microsoft in June 2025. The phishing operation replicated this technique, using .url shortcuts to launch legitimate binaries while redirecting their working directories to attacker-controlled WebDAV shares.
Comprehensive Testing and Techniques
The operator’s README files revealed attempts to bypass security measures without triggering alerts, claiming that their methods would run unnoticed. A notable aspect was the extensive testing involved, with 59 different .url files targeting various signed binaries, each with a theoretical basis for success. This suggested a methodical approach to identifying effective hijacking techniques.
The operation also explored other vulnerabilities, such as the MSHTML bypass and NTLM-leak, though the WebDAV hijack remained the primary focus. The documentation, characterized by verbose and emoji-rich formatting, pointed to the use of a large language model (LLM) in the development process.
Impact on Mexican Users and Future Threats
The campaign predominantly targeted Mexican users, with a fake government ID lookup site serving as the phishing vector. The site delivered a disguised .scr file that executed an infostealer, harvesting sensitive information such as cryptocurrency wallets and browser credentials. A secondary campaign used a different method, deploying a trojanized DLL through a signed binary to spread a modular RAT.
During a brief surge from June 20 to 26, 2026, the delivery panel recorded over 77,000 requests, with the majority of traffic originating from Mexico. Although the campaign has since subsided, the methodology remains a significant concern for cybersecurity experts, who warn of its potential use in future attacks.
Rapid7 has published indicators of compromise (IOCs) related to the campaign, advising defenders to monitor for specific behaviors and block identified C2 addresses and file hashes. The operation’s use of AI tools designed for legitimate coding tasks underscores the evolving nature of cyber threats and the need for adaptive defense strategies.
