Tag: WebDAV Malware Campaign

The entire toolkit—1,048 files that included lure templates, filename-spoofing tests, execution experiments, droppers, builder notes, and two campaign chains—was taken down by Rapid7 when a malware operator left its delivery server open. One was already operational against Mexican Windows users, using WebDAV to deploy an infostealer via a phony official ID-lookup website. It caught the activity mid-build, which makes it more than just a payload dump. Testing notes, unsuccessful experiments, documentation, and live delivery logs were all in one location—the kind of comprehensive development trail that defenders seldom encounter. Rapid7 uses generative AI as an operator to quickly create, test, and record phishing delivery by reading the artifacts down to a hardcoded path linking to a...