Exposed Server Reveals AI-Assisted Phishing Toolkit Behind WebDAV Malware Campaign

A cybercriminal operator left a server exposed, revealing an AI-assisted phishing toolkit used in a WebDAV-based malware campaign targeting Mexican users. The attacker leveraged generative AI to accelerate development and testing of social engineering lures and delivery mechanisms, including filename spoofing with right-to-left override (RTLO) and abuse of signed Windows binaries via a working directory hijack. The primary campaign delivered a .NET infostealer through a fake government ID site, while a secondary campaign used a trojanized DLL sideloaded via a signed Ubisoft binary to deploy a modular .NET RAT. The operation demonstrates a sophisticated, software-like development lifecycle enabled by AI tools.

AI-extracted · verify before operational use