AI-Assisted Phishing Toolkit Exploiting WebDAV Vulnerability Exposed in Open Server

An exposed server revealed an AI-assisted phishing toolkit using WebDAV vulnerabilities to deliver infostealers targeting Mexican users, with evidence of LLM-generated attack patterns and exploit development. The toolkit leveraged AI coding tools to automate phishing campaigns and test multiple signed binary hijacking techniques, including CVE-2025-33053, with active campaigns observed in June 2026.

A malware operator left its delivery server wide open, and Rapid7 pulled down the whole toolkit: 1,048 files spanning lure templates, filename-spoofing tests, execution experiments, droppers, builder notes, and two campaign chains. One was already live against Windows users in Mexico, delivering an infostealer through a fake government ID-lookup site over WebDAV.

What makes it more than a

Read original article