Rapid7 Uncovers AI-Assisted Phishing Toolkit Targeting Windows Users in Mexico

A malware facilitator left a delivery server open online, allowing Rapid7 researchers to download its entire toolkit. The collection contained 1,048 files linked to phishing and malware development.

The files included fake lures, filename tests, malware experiments, and delivery tools. Researchers also found notes that explained how the operator tested different attack methods. The server also contained evidence of two separate campaign chains. One campaign was already active against Windows users in Mexico.

That campaign used a fake government website to trick users into downloading malware. The malware reached victims through WebDAV, a system that lets computers access files stored remotely.

The exposed files gave researchers a rare view into how the operation developed. The collection showed failed tests, working experiments, written instructions, and records from the live campaign.

Rapid7 said the material suggested that the operator used generative artificial intelligence to speed up the work. The files appeared to show an AI-assisted process for creating, testing, and recording attack methods.

Researchers Find a Large Malware Development Toolkit

Rapid7 found that the operator tested several ways to deliver malware to Windows computers. The most detailed testing focused on CVE-2025-33053, a Windows flaw rated 8.8 on the CVSS scale. CISA has also listed the flaw in its Known Exploited Vulnerabilities catalog.

The flaw involves a technique that abuses Windows shortcut files and WebDAV connections. The development of such malware reflects a growing market; a threat actor has been advertising a Windows malware platform on cybercrime forums.

The method can make a trusted Windows program load a harmful file from a remote location. The operator appeared to recreate the technique described in earlier security research.

The attack uses a .url shortcut file to start a legitimate Windows program. The shortcut then points the program’s working folder toward a WebDAV location controlled by the attacker. Windows may then load a harmful file from that remote location instead of the legitimate file.

The operator’s own notes claimed the method could avoid common security warnings. One recovered README described the method as working without security warnings or alerts. Microsoft fixed the original flaw in June 2025.

However, the exposed server showed that the operator continued testing the method. One recovered README also contained the same example path used in an earlier security report. The operator then expanded the testing into a much larger collection.

One test kit contained 59 .url files aimed at different signed Windows programs. The list included .NET programs such as InstallUtil and RegAsm. It also included programs listed in LOLBAS, a project that tracks legitimate Windows tools. The operator even tested some programs that could potentially help bypass Windows security controls.

The notes did not confirm that every test worked. Instead, they treated the files as possible methods that needed further testing. The operator had a clear reason for exploring new options. The original attack method no longer worked on Windows 11 version 24H2.

That change happened because Internet Explorer was removed from the operating system. The server also contained smaller test collections involving two other Windows flaws. One involved the MSHTML bypass CVE-2026-21513. Another involved the NTLM leak flaw CVE-2025-24054. However, the WebDAV technique remained the main focus of the operation.

Rapid7 also found several clues in the files that pointed toward AI-assisted work. The researchers examined the READMEs, phishing guides, testing documents, and a file named _MAPPING.csv. That file connected individual test files with their target Windows programs.

Rapid7 said the documents showed patterns often linked with large language model output. The researchers pointed to repeated formatting, detailed writing, and frequent use of emojis. The phishing website also contained JavaScript with many emojis. The files used Russian comments and folder names, including one called “testik.” The name is a smaller form of the Russian word for “test.”

These clues suggested a Russian-speaking operator, but they did not identify the person behind the campaign. Rapid7 linked the work to an AI-assisted process that likely used Coderrr, written as “CodeRRR.” The Hacker News reported that the tool was publicly available as of July 20, 2026.

The tool is a general open-source AI coding agent inspired by other coding assistants. Rapid7 described the operation as an example of attackers using AI like a modern software development team. The operator also left an administration panel called Simba Service on the same server. The panel still used its default port and default login details.

Active Campaign Targeted Mexican Windows Users

Rapid7’s investigation connected the exposed server to an active campaign targeting people in Mexico. The campaign used the domain gobf[.]mx, which closely resembled the Mexican government’s CURP lookup service.

CURP is used for national identification records in Mexico. The fake website showed users a page that appeared to help them retrieve their records. The download button then triggered a search-ms query. That action opened the attacker’s WebDAV share through Windows Explorer. The page also filtered the search toward files with the .scr extension.

The main lure looked like a CURP PDF report. However, the file was actually a .scr executable. The attacker used a right-to-left override character to make the filename appear like a PDF. The file used an Inno Setup installer to unpack the malware.

It then launched a .NET information-stealing program directly in computer memory. The malware also ran inside a signed Qihoo 360 process after taking control of its memory. The infostealer targeted several types of valuable information from infected computers. It collected cryptocurrency wallet information, browser passwords, and session cookies. It also targeted Telegram sessions.

The exposed server contained another campaign called DirtyGames. That campaign used a different method to deliver its malware. It placed a harmful DLL beside a trusted Ubisoft program. The trusted program then loaded the harmful file, allowing the attacker to start a modular .NET remote access trojan.

Rapid7 told The Hacker News that both campaigns eventually delivered the same final malware. The researchers identified malware as the known .NET threat called PureRAT. The delivery panel also provided information about the scale of the activity.

During about 5.5 days, from June 20 through June 26, 2026, the panel recorded 77,098 requests. Those requests came from 3,892 unique IP addresses across 101 countries. Mexico accounted for 82.5% of the total traffic during that period.

Mexico also produced 96.9% of all recorded launch activity. One CURP lure alone produced 2,384 of the 2,441 recorded launch events. That represented about 97.7% of all launch events during the campaign. Rapid7 warned that these figures do not prove how many people became infected.

The company counted a launch event when its panel received a request or opened an executable. The measurement did not confirm that malware successfully ran on a victim’s computer. Rapid7 said it could not see the number of actual infections.

The company therefore could not confirm the campaign’s total number of compromised devices. Some traffic from the United States and Germany also appeared more consistent with scanning activity.

The timing of the campaign offered another clue about its targets. Most activity happened during Mexican working hours. Rapid7 said that the pattern appeared more consistent with real users than automated scanning.

Rapid7 Warns Attackers May Continue Testing New Methods

The Rapid7 researchers said the June 2025 Microsoft update closed the original attack path involving iediagcmd.exe. However, the 59-file testing kit showed that the operator was searching for other options. The operator appeared interested in signed Windows programs that could behave in similar ways.

Rapid7 published indicators connected to both campaigns. Those indicators include command-and-control addresses and file hashes. The company also made the information available through its GitHub repository. Security teams can use those indicators to help identify and block the campaign.

Rapid7 also highlighted several behaviors that security teams should watch. One warning sign involves the WebClient service starting on a computer. Another involves davclnt.dll connecting to a remote system.

Defenders should also watch when a trusted signed program starts another file. That file may have an image path located on a WebDAV or UNC network share. Security teams should also check suspicious filenames using RTLO characters.

Attackers may also use double file extensions or add extra spaces before .exe or .scr files. The campaign’s delivery activity began to slow after June 24. However, the exposed files showed how quickly attackers can develop and test new phishing methods.

The operation combined common AI coding tools with malware delivery work. The tools themselves were not created specifically for cybercrime. The files instead showed how an attacker adapted a general AI coding tool for malicious work. 

Rapid7 said the operator appeared to build a repeatable process for creating and testing phishing attacks. The company also said it was working to notify CERT-MX about the activity. The exposed server gave researchers a detailed look at an operation while it was still developing.

The files showed the operator’s testing process, active campaigns, and plans for finding new attack methods. The campaign also showed how attackers can use trusted software and common Windows features. Rapid7’s findings provide defenders with indicators and behaviors they can monitor for related activity.