Executive Summary
Rapid7 pulled an exposed operator's toolkit of 1,048 files showing an AI-assisted phishing workflow behind a WebDAV infostealer campaign in Mexico.
What Happened
A malware operator left its delivery server wide open, and Rapid7 pulled down the whole toolkit: 1,048 files spanning lure templates, filename-spoofing tests, execution experiments, droppers, builder notes, and two campaign chains. One was already live against Windows users in Mexico, delivering an infostealer through a fake government ID-lookup site over WebDAV. What makes it more than a
Affected Products
- Windows
Vulnerability / Attack Technique
AI-assisted phishing development
Technical Mechanism
As reported, AI helped build lures and test execution.
AI Security Category
AI-assisted attack
Part of the AI-Assisted Attacks topic.
RealGround Analysis
AI speeds criminal tooling iteration.
Recommended Controls
- Block WebDAV from untrusted sites
Related RealGround Service
AI Red Teaming · or start with the free AI Agent Security Scanner.
Sources
thehackernews.com: https://thehackernews.com/2026/07/exposed-server-reveals-ai-assisted.html
Summary and analysis written by RealGround from the source above; last updated 2026-10-18.