A misconfigured server exposed the complete toolkit behind an active malware campaign using AI-assisted phishing techniques. Rapid7 researchers discovered and downloaded 1,048 files from the unprotected infrastructure, revealing the operational backbone of a WebDAV-based malware delivery operation targeting Windows systems.

The toolkit contains lure templates, filename-spoofing tests, execution experiments, droppers, and builder documentation that detail how the threat actors construct and deploy their attacks. The cache shows two active campaign chains. One targets Mexican users through a fraudulent government ID-verification website distributing an infostealer payload via WebDAV protocol.

The use of WebDAV for malware delivery presents a specific technical challenge for defenders. The protocol leverages legitimate file-sharing functionality, allowing attackers to host payloads on compromised or controlled servers that appear innocuous to basic network monitoring. The fake government ID site serves as the initial lure, exploiting trust in official services to trick users into downloading malicious files.

The AI-assisted component indicates the operators employ machine learning tools to generate or refine phishing content, likely increasing the volume and personalization of social engineering attempts. This automation reduces manual effort while testing multiple message variations to maximize infection rates.

The exposure provides defenders with actionable intelligence. Organizations can examine the leaked templates and tactics to identify similar phishing emails targeting their users. The filename-spoofing tests reveal techniques for disguising executables as documents, a common evasion method that antivirus and endpoint detection systems must flag.

For Mexican organizations and government agencies, the active campaign demands immediate action. Users should treat unsolicited ID-verification requests with extreme skepticism, regardless of apparent legitimacy. Security teams should block WebDAV traffic where unnecessary and monitor for suspicious file transfers using the protocol.

The incident underscores a persistent operator weakness: inadequate operational security. Threat actors who