Misconfigured Server Blows Cover on AI-Assisted Phishing Operation Targeting Mexico
Someone forgot to lock their delivery server, and Rapid7 walked straight in. What they found wasn't just a payload — it was an entire operation caught mid-build: over a thousand files covering lure templates, dropper scripts, builder notes, testing documentation, and two active campaign chains. One of those chains was already running against Windows users in Mexico.
The technical centrepiece is CVE-2025-33053, a WebDAV working-directory hijack with a CVSS score of 8.8, now sitting in CISA's Known Exploited Vulnerabilities catalogue. Check Point had already documented this technique in its Stealth Falcon reporting. The short version: a crafted .url shortcut launches a legitimate, signed Windows binary, but points its working directory at an attacker-controlled WebDAV share. Because the binary calls helpers like route.exe by bare filename rather than full path, Windows goes looking in the working directory first — which, in this case, is the remote share. The attacker's route.exe loads instead of the real one in System32.
The operator's own README crowed about it running without SmartScreen or Mark-of-the-Web warnings. Zero alerts. Microsoft patched it in June 2025.
What's striking is how visibly the operator copied their homework. One recovered README preserved the exact example path from Check Point's original writeup, summerartcamp[.]net@ssl@443\DavWWWRoot\OSYxaOjr, verbatim. Then they went further. A test kit expanded the single iediagcmd.exe trick into 59 .url files, each targeting a different signed Windows binary: .NET utilities like InstallUtil and RegAsm, LOLBAS staples, UAC-bypass candidates. Every entry came with a written theory of why the hijack should work on that binary and a suggested testing order.
The reason for building such a comprehensive list? The original technique falls apart on Windows 11 24H2, because Internet Explorer — and therefore iediagcmd.exe — no longer exists. So the operator went looking for substitutes. The folder also contained smaller test sets probing two other flaws, the MSHTML bypass CVE-2026-21513 and the NTLM-leak CVE-2025-24054, but the WebDAV hijack was clearly the main focus.
The AI angle is what Rapid7 found most notable. The READMEs, lure-generation guides, matrix-style testing write-ups, and a _MAPPING.csv cross-referencing each test file against its target binary all carry what Rapid7 describes as the templated formatting, unusual verbosity, and emoji-heavy structure associated with LLM output. The phishing site's JavaScript read the same way. A hardcoded path in the code pointed to Coderrr — rendered 'CodeRRR' by Rapid7 — a public, open-source AI coding agent inspired by Claude Code, GitHub Copilot CLI, and Cursor. Nothing custom, nothing attacker-specific. Just commodity tooling repurposed for building phishing infrastructure. Rapid7's characterisation was direct: the attacker operated 'more like a modern software product team.'
The Russian comments and a folder named testik — a diminutive form of 'test' in Russian — suggest a Russian-speaking operator, though they don't get any more specific than that.
The live campaign used gobf[.]mx, a typosquat of Mexico's official CURP national ID lookup site. Victims landing on the fake page hit a download button that fired a search-ms: URI, popping open the attacker's WebDAV share as a Windows Explorer search window filtered to show only .scr files. The primary lure looked like a CURP PDF report. It was actually a .scr executable with its filename reversed using a right-to-left Unicode override character to make it appear to end in .pdf.
Inside was an Inno Setup installer that unpacked a loader and ran a .NET infostealer entirely in memory, hollowed into a signed Qihoo 360 process. It was after cryptocurrency wallets, browser credentials, session cookies, and Telegram sessions. A second campaign directory labelled DlrtyGames went a different route, sideloading a trojanised DLL through a signed Ubisoft binary to deliver a modular .NET RAT. Both chains reportedly end at the same final payload: PureRAT.
Over roughly five and a half days between June 20 and 26, 2026, the delivery panel logged 77,098 requests from 3,892 unique IPs across 101 countries. Mexico accounted for 82.5% of traffic and nearly 97% of launch events. A single CURP lure drove around 2,384 of the 2,441 total launch events. Worth noting: Rapid7 defines a 'launch event' as a client requesting or opening an executable from the share, not a confirmed execution on an endpoint. Traffic from the US and Germany looked more like scanner noise. Actual infection numbers are unknown. Activity clustered around Mexican working hours, which at least suggests real humans rather than automated probes.
The server also had its admin panel — something called Simba Service — sitting on the same box with default credentials intact. Classic.
For defenders: the June 2025 patch closes the original iediagcmd.exe path, but the 59-file test kit makes it clear the operator was actively searching for other signed binaries that behave identically. Rapid7 has published indicators for both campaigns on GitHub. Beyond the IOCs, watch for the WebClient service starting unexpectedly, davclnt.dll reaching out to remote hosts, signed binaries spawning children whose image paths point to WebDAV or UNC shares, and filenames using the RTLO character (U+202E), double extensions, or padding before .exe or .scr.
The delivery burst cooled off after June 24. What doesn't cool off is the approach: commodity AI coding tools, built for developers and never intended for this, wired into a repeatable pipeline for producing, testing, and deploying phishing infrastructure. Rapid7 said it is in the process of notifying CERT-MX.