"WITHOUT any security warnings. Zero alerts!" — an operator's README, recovered by Rapid7.
Rapid7 pulled an exposed, mid‑build phishing toolkit: 1,048 files
Rapid7 discovered and removed an entire delivery server that an operator left openly accessible. The repository contained 1,048 files: lure templates, filename‑spoofing tests, execution experiments, droppers, builder notes and two campaign chains. The collection included testing notes, failed experiments, documentation and live delivery logs — a development trail defenders rarely see. Rapid7 observed a hardcoded path pointing at an open‑source AI coding tool and reads the README files, lure guides and CSV mappings as the output of an LLM‑assisted workflow.
CVE-2025-33053: the WebDAV working‑directory hijack at the center
The most developed test set focused on CVE-2025-33053 (CVSS 8.8, listed in CISA's KEV catalog), the WebDAV working‑directory hijack Check Point documented in its Stealth Falcon research. The technique abuses a .url shortcut to launch a signed Windows binary while setting its working directory to an attacker‑controlled WebDAV share. In the original abuse, the shortcut launched iediagcmd.exe, an Internet Explorer diagnostics tool that starts helpers such as route.exe by bare filename; with the working directory pointed at the remote share, Windows loads the attacker's route.exe from WebDAV instead of the legitimate System32 copy. Rapid7 recovered a README preserving the exact example path from the earlier report: summerartcamp[.]net@ssl@443\DavWWWRoot\OSYxaOjr. Microsoft patched the flaw in June 2025.
Live campaigns: gobf[.]mx and DlrtyGames, heavy activity in Mexico
Rapid7 traced an active campaign to gobf[.]mx, a typosquat of the government's CURP national‑ID lookup. The fake site presented a record‑retrieval page whose download button fired a search‑ms:query that opened the operator's WebDAV share as a Windows Explorer search filtered to .scr files. The most‑delivered lure resembled a CURP PDF but used a right‑to‑left override (RTLO) to present a .scr executable as a PDF. That drop was an Inno Setup installer that unpacked a loader and ran a .NET infostealer entirely in memory, hollowed into a signed Qihoo 360 process. The stealer harvested cryptocurrency wallets, browser credentials, session cookies and Telegram sessions.
A second campaign directory, DlrtyGames, used a different approach: sideloading a trojanized DLL through a signed Ubisoft binary to drop a modular .NET RAT. Delivery logs from roughly 5.5 days (June 20–26, 2026 UTC) show 77,098 requests from 3,892 unique IPs in 101 countries; Mexico generated 82.5% of traffic and 96.9% of launch activity. A single CURP lure accounted for 2,384 of the 2,441 launch events — about 97.7%. Rapid7 cautions that a "launch event" is a client request or an open of an executable from the share, not a confirmed endpoint infection. Traffic from the US and Germany resembled scanning, while activity clustered in Mexican working hours. The delivery burst cooled after June 24.
LLMs, Coderrr (rendered "CodeRRR"), and exposed admin tooling
Rapid7 characterizes the operation as LLM‑assisted: READMEs, emoji‑heavy JavaScript, matrix‑style test writeups and a _MAPPING.csv file match the templated formatting Rapid7 associates with LLM output. The repository included a hardcoded path to an open‑source AI coding agent that Rapid7 links to Coderrr (rendered in the report as "CodeRRR"). The Hacker News confirmed that Coderrr is a general‑purpose, open‑source AI coding agent — inspired by Claude Code, GitHub Copilot CLI and Cursor — and that the repository was public as of July 20, 2026. The operator even left the delivery panel — an admin tool called Simba Service — running on the same server with its default port and credentials unchanged.
What this means for security teams, policymakers, and Mexican users
- Security teams: Rapid7 has published indicators of compromise (IOCs) for both campaigns, including C2 addresses and file hashes, on its GitHub; Rapid7 advises blocking those first. Also monitor for behavior the IOCs miss: the WebClient service starting, davclnt.dll connecting to a remote host, a signed binary spawning a child whose image path sits on a WebDAV or UNC share, and filenames using RTLO (U+202E), double extensions or padding before .exe/.scr.
- Policymakers and regulators: CVE-2025-33053 is in CISA's Known Exploited Vulnerabilities catalog and Microsoft issued a patch in June 2025; the recovered kit shows attackers probing a broad set of signed binaries beyond the original iediagcmd.exe vector, signaling continued risk where legacy behaviors persist or alternative signed binaries behave similarly.
- Mexican users and enterprises: The campaign concentrated heavily on a CURP typosquat (gobf[.]mx) and clustered in Mexican working hours. Organizations and users should be aware that a seemingly benign national‑ID PDF download can be a disguised .scr using RTLO and that delivery reach does not equate to confirmed compromise.
Rapid7's takedown exposed not only payloads but the development pipeline: a commodity AI agent, templated documentation, and an admin panel left online. The delivery burst was short‑lived, but the recovered artifacts show an operator who wired general‑purpose AI tooling into a repeatable phishing product team. The Hacker News has reached out to Rapid7 for clarification of final payload identification and the current status of the exposed infrastructure and will update the record with any response.
