Exposed Server Reveals AI-Assisted Phishing Toolkit Behind WebDAV Malware Campaign

A malware operator left its delivery server wide open, and Rapid7 pulled down the whole toolkit: 1,048 files spanning lure templates, filename-spoofing tests, execution experiments, droppers, builder notes, and two campaign chains. One was already live against Windows users in Mexico, delivering an infostealer through a fake government ID-lookup site over WebDAV. What makes it more than a

The article describes a malware operator whose exposed WebDAV-based delivery server revealed a large phishing and malware 'lab' with over 1,000 artifacts, including AI-assisted lure templates, filename spoofing tests, and campaign chains targeting Windows users in Mexico via a fake government ID-lookup site.[1][3] According to the analysis, generative AI was systematically used to rapidly design and iterate phishing content and delivery methods, significantly increasing the efficiency and quality of social-engineering attacks.[3][6] From a RealGround perspective, this is a clear case of malicious AI use where general-purpose coding and content agents are weaponized to industrialize phishing and malware delivery, indicating that organizations need proactive controls that treat AI-assisted phishing as a baseline threat rather than an edge case. Practical implications include the need for continuous AI-focused red teaming of email, web, and WebDAV-exposed assets, and secure AI agent build practices that restrict model capabilities, logging, and access to prevent similar abuse of internal AI tooling for high-volume phishing operations.