**Rapid7** researchers have gained extraordinary insight into a malware operation after its delivery server was left unsecured. The exposed infrastructure contained a treasure trove of over 1,000 files, detailing a sophisticated, in-progress phishing campaign. This discovery offers a rare glimpse into the development and testing methodologies of a threat actor, including the use of generative AI. ### The Exposed Lab: A Developer's Trail The toolkit comprised lure templates, filename-spoofing tests, execution experiments, droppers, builder notes, and two active campaign chains. One of these was actively targeting Windows users in Mexico, delivering an infostealer via a deceptive government ID-lookup site utilizing **WebDAV**. What makes this exposure particularly significant is that it captured the operation mid-build. The presence of testing notes, failed experiments, documentation, and live delivery logs provides a complete development trail rarely seen by defenders. ### AI at the Core of Operations **Rapid7**'s analysis of the artifacts, including a hardcoded path pointing to an open-source AI coding tool, suggests the operator leveraged generative AI to accelerate the production, testing, and documentation of their phishing delivery methods. The templated formatting, verbosity, and emoji-heavy structure of READMEs, lure-generation guides, and test write-ups strongly indicate **LLM** (Large Language Model) output. The research points to the likely use of **Coderrr**, a general-purpose, open-source AI coding agent, demonstrating how threat actors are integrating commodity AI tools into their attack pipelines. As **Rapid7** bluntly summarized, "the attacker used LLMs to operate more like a modern software product team." ### Exploiting WebDAV Vulnerabilities  A significant portion of the testing focused on **CVE-2025-33053** (CVSS 8.8), a **WebDAV** working-directory hijack vulnerability documented by **Check Point** in its **Stealth Falcon** report. This technique abuses a `.url` shortcut to launch a legitimate signed Windows binary while redirecting its working directory to an attacker-controlled **WebDAV** share. In the original attack, this method allowed the attacker to load their malicious `route.exe` from **WebDAV** instead of the legitimate one from `System32`, bypassing **SmartScreen** and **Mark-of-the-Web** warnings. Although **Microsoft** patched this flaw in June 2025, the operator's notes closely mirrored **Check Point**'s write-up, even preserving example paths. The attacker expanded this single technique into a "comprehensive test kit" with 59 `.url` files targeting various signed binaries, including .NET tools like `InstallUtil` and `RegAsm`, and **LOLBAS** entries. This extensive testing was motivated by the fact that the original trick no longer works on **Windows 11 24H2** due to the removal of Internet Explorer and `iediagcmd.exe`. The directory also contained smaller test sets for other vulnerabilities, including **CVE-2026-21513** (MSHTML bypass) and **CVE-2025-24054** (NTLM-leak), though the **WebDAV** hijack remained the primary focus. ### Active Campaign and Impact  The operator also left their delivery panel, an admin tool named **Simba Service**, exposed with default credentials. This panel revealed an active campaign targeting Mexican users through `gobf[.]mx`, a typosquat of the government's **CURP** national-ID lookup site. Victims were served a fake record-retrieval page that, upon clicking a download button, initiated a `search-ms:` query. This opened the operator's **WebDAV** share as a Windows Explorer search filtered to `.scr` files. The primary lure, disguised as a **CURP** PDF report using a right-to-left override (RTLO) character, was an Inno Setup installer. It deployed a .NET infostealer in memory, hollowed into a signed **Qihoo 360** process, to steal cryptocurrency wallets, browser credentials, session cookies, and Telegram sessions. A second campaign, `DlrtyGames`, utilized a different approach, sideloading a trojanized DLL through a signed **Ubisoft** binary to drop a modular .NET **RAT**. Over a 5.5-day period (June 20-26, 2026 UTC), the delivery panel logged 77,098 requests from 3,892 unique IPs across 101 countries. Mexico accounted for 82.5% of traffic and 96.9% of launch activity, with a single **CURP** lure responsible for 97.7% of launch events. This activity clustered during Mexican working hours, consistent with real users rather than automated scanners. ### Defender's Call to Action While the June 2025 patch addressed the original `iediagcmd.exe` path, the 59-file kit demonstrates the attacker's ongoing search for other signed binaries susceptible to similar hijack techniques. **Rapid7** has published indicators of compromise (**IOCs**) for both campaigns, including C2 addresses and file hashes, on their [GitHub](https://github.com/rapid7/Rapid7-Labs/tree/main/IOCs/Simba%20Panel). Organizations should prioritize blocking these **IOCs**. Beyond **IOCs**, defenders should monitor for behavioral anomalies: the **WebClient** service initiating and `davclnt.dll` reaching a remote host, a signed binary spawning a child whose image path resides on a **WebDAV** or **UNC** share, and filenames employing **RTLO** (`U+202E`), double extensions, or padding before `.exe` or `.scr`. The short-lived delivery burst may have cooled, but the underlying methodology persists: an operator leveraging commodity **AI** coding tools, never designed for malicious use, to create a repeatable pipeline for producing and testing phishing delivery, ready for the next target.