Cases › security breach › LR-2026-0620
Exposed server reveals AI-assisted phishing toolkit behind WebDAV malware
Preliminary Why: 1 report: The Hacker News · subject to change · 1 independent report
Status: no action reported
No source states: loss or records, developer and model, agent tool, could do, deployer, industry.
Severity moderate: Test: data of others touched with a bounded scope stated. The stealer took wallets, browser credentials, session cookies and Telegram sessions from delivered victims; the real compromise count is not confirmed.
Rapid7 found a malware operator's delivery server wide open, exposing a toolkit of 1,048 files. The toolkit included phishing lures and tests of a Windows WebDAV working-directory hijack (CVE-2025-33053), and Rapid7 reads the artifacts as produced with generative AI. One campaign was live against Windows users in Mexico, delivering an infostealer through a fake government ID-lookup site over WebDAV. Over roughly 5.5 days in June 2026, the delivery panel logged 77,098 requests from 3,892 unique IPs. Those figures measure delivery reach rather than confirmed infections, since Rapid7 counts launch events and cannot see actual infections. Rapid7 said it is notifying CERT-MX.
What happened
No source tells the story step by step yet.
What was done
No source states an action or fix.
Risks
Primary96 incidents
Rising: 24 vs 4.0 a week
Read from the sources; not yet reviewed by a person.
Controls
Infrastructure / targetNot effective Inventory of exposed services
Control failure chain
L1 · ModelProvider not namedModel provider
No source mentions a control at this layer.
Model version not linked to a model card.
Other controls for this risk at this layer, not mentioned in the sources: Safety training and refusal, Cyber and weapons safeguards, Abuse monitoring and account enforcement, Staged or restricted release, Dangerous-capability testing before release, Outside red-teaming, Content safety classifiers, Safeguards kept on in testing, Reasoning monitoring.
L2 · HarnessHarness not namedAgent framework vendor
No source mentions a control at this layer.
L3 · ApplicationThe attackerDeployer
The attacker ran the agent; this layer was the attacker's own.
L4 · Infrastructure / targetOrganisation hit
Other controls for this risk at this layer, not mentioned in the sources: Known flaws patched, Multi-factor sign-in and password policy, Network segmentation, Intrusion and endpoint detection, Backups and recovery, Phishing and fraud filters.
EffectiveNot effectiveNot effective (bypassed)Did not existNot stated in sourcesNot yet checkedAttacker's ownOrder: model · harness · application · target
Controls for this risk: result in this incident
| Control | Part of the system | Result |
|---|---|---|
| Content safety classifiers | L1 Model | Not stated in sources |
| Safety training and refusal | L1 Model | Not stated in sources |
| Cyber and weapons safeguards | L1 Model | Not stated in sources |
| Dangerous-capability testing before release | L1 Model | Not stated in sources |
| Outside red-teaming | L1 Model | Not stated in sources |
| Staged or restricted release | L1 Model | Not stated in sources |
| Abuse monitoring and account enforcement | L1 Model | Not stated in sources |
| Reasoning monitoring | L1 Model | Not stated in sources |
| Safeguards kept on in testing | L1 Model | Not stated in sources |
| Inventory of exposed services | L4 Infrastructure / target | Not effective |
| Known flaws patched | L4 Infrastructure / target | Not stated in sources |
| Multi-factor sign-in and password policy | L4 Infrastructure / target | Not stated in sources |
| Network segmentation | L4 Infrastructure / target | Not stated in sources |
| Intrusion and endpoint detection | L4 Infrastructure / target | Not stated in sources |
| Backups and recovery | L4 Infrastructure / target | Not stated in sources |
| Phishing and fraud filters | L4 Infrastructure / target | Not stated in sources |
Evidence
- Cause a shared system was the path
No source states: a step-by-step account, when it was found, the direct loss, a count of the other parties affected, any court case, what set it off, what was done.
Show the full account: 5 items from the primary sources
What happened, in order
- June 2025 Microsoft patched the WebDAV working-directory flaw (CVE-2025-33053).
- June 20 to 26, 2026 UTC The delivery panel logged requests over roughly 5.5 days.
- after June 24 The delivery burst cooled.
- July 20, 2026 The Hacker News confirmed the repository was public.
Not dated in the sources:
- Rapid7 said it was notifying CERT-MX.
Show every field, with its source and grade
What happened
Impact
Context
Notes on gaps
The AI tool's role is Rapid7's inference (likely LLM-assisted), not a confirmed fact; the named tool Coderrr is only a likely attribution. Infection and victim counts are not stated; the 77,098 requests and 2,441 launch events measure delivery reach only. Harm classes financial and privacy inferred from the stolen wallet and credential data. Remediation recorded is advice from Rapid7 to watch behaviour; no fix by a party was reported.
LR-2026-0620 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON