Rapid7 Grabs 1,048 Files From Exposed Phishing Server

Every so often an attacker forgets to lock the front door. This time a malware operator left its delivery server wide open, and Rapid7 walked off with 1,048 files: lure templates, filename-spoofing experiments, dropper builds, README notes, and two live campaign chains. One was already running against Windows users in Mexico, dressed up as a government ID lookup and quietly siphoning wallets, browser credentials and Telegram sessions.

What makes the haul unusual is that it caught the operation mid-build. Testing notes, failed experiments and delivery logs were all sitting in one place, unshuffled and legible.

A patched bug, being pushed past the patch

The most developed test kit reproduced CVE-2025-33053, the WebDAV working-directory hijack that Check Point documented in its Stealth Falcon research. The trick uses a .url shortcut to launch a legitimate signed Windows binary while pointing its working directory at an attacker-controlled WebDAV share. Microsoft patched it in June 2025, but the operator was already scoping out life after the fix, expanding the technique into 59 .url files aimed at other signed binaries, each with a written theory and a tiered testing order.

Fingerprints on the paperwork

The evidence is all over the documentation. Rapid7 reads the templated READMEs, matrix-style write-ups, mapping CSVs and emoji-heavy JavaScript as LLM output, likely produced with help from Coderrr, an open-source AI coding agent inspired by Claude Code and Cursor. Russian comments and a folder called testik place the operator in a Russian-speaking context. The delivery panel, an admin tool called Simba Service, was still sitting on the same server with its default port and credentials intact.

The live campaign

The active chain ran through gobf[.]mx, a typosquat of Mexico's CURP national-ID service. The download button fired a search-ms query that opened the attacker's WebDAV share as a filtered Explorer view, serving a .scr file whose filename used a right-to-left override so it read as a PDF. Behind the icon sat an Inno Setup installer that unpacked a .NET infostealer in memory and hollowed it into a signed Qihoo 360 process.

Over roughly 5.5 days in late June, the panel logged:

• 77,098 requests from 3,892 IPs across 101 countries
• 82.5% of traffic from Mexico
• 97.7% of launch events from a single CURP lure

The method, not the burst

The campaign itself was short-lived. What matters is the workflow. Someone wired commodity AI coding tools, none of them built for offensive work, into a repeatable pipeline for producing, testing and documenting phishing delivery. The patch closed one door. The 59-file test kit shows an operator already hunting for the next one, and the lure that did most of the damage was, in the end, a filename dressed up to look like a PDF.