Exposed Server Reveals AI-Assisted Phishing Toolkit Behind WebDAV Malware Campaign

A malware operator inadvertently exposed their delivery server, allowing Rapid7 to obtain the entire toolkit. The toolkit consists of 1,048 files, including templates, tests, and other materials used for phishing campaigns. One of the campaigns was actively targeting Windows users in Mexico, using a fake government ID-lookup site to deliver an infostealer via WebDAV. The exposed server revealed the scope and complexity of the operator's phishing efforts. The toolkit's contents provide insight into the tactics and techniques used by the malware operator. The campaign's use of AI-assisted phishing methods adds to its sophistication.