While chasing a single malware alert, researchers at Rapid7 stumbled onto something far bigger: an exposed server that was not just hosting payloads but running as a full malware delivery lab. The open directory held more than 1,000 files, and the way they were organized read less like a criminal stash and more like the workspace of a software product team, complete with test kits, README guides, and quality-assurance notes. Much of that material, Rapid7 says, appears to have been generated with large language models.
The find matters because it shows how generative AI is changing the tempo of everyday cybercrime. Instead of hand-crafting one lure at a time, the operator used LLMs to bulk-produce shortcut lures, write step-by-step attack documentation, and systematically test which tricks slipped past Windows defenses. IntelFusions has tracked this shift before, from vendors warning that AI has crossed from hacking assistant to attack operator to a run of AI-assisted malware and botnet cases.
What was on the server
The 1,048 files clustered into clear functions: 453 shortcut launchers, 236 filename-spoofing tests, 146 experiments with signed Windows binaries and remote execution, plus encrypted droppers, ClickFix web pages, and operator notes. Some folders were named "testik," a Russian diminutive for "test," and several README files preserved the tell-tale emojis, formatting, and phrasing of LLM output.
How the attacks work
The most developed test set targeted CVE-2025-33053, a Windows shortcut flaw that lets a file set its working directory to an attacker-controlled WebDAV share. When a victim opens a booby-trapped .url file, a legitimate signed Windows tool launches but pulls its helper programs from the attacker's remote share instead of the local system, running malicious code with no SmartScreen or Mark-of-the-Web warning. The operator also stockpiled fallback methods for machines where the original tool is missing, and studied related flaws CVE-2026-21513 and CVE-2025-24054.
To reel victims in, the crew leaned on ClickFix pages that imitate Cloudflare checks, document errors, and login prompts to trick users into copying and running a command themselves. One live case study impersonated Mexico's CURP national-ID lookup service through the typosquatted site hxxps://gobf[.]mx, spoofing the real hxxps://www[.]gob[.]mx/curp/ to push a fake record download that quietly delivered a fileless .NET information stealer. A second chain, disguised as game installers, sideloaded a trojanized DLL to run PureRAT inside a signed process. Both ultimately harvested credentials, browser data, crypto wallets, and messaging sessions.
Indicators and defense
Rapid7 tied stolen data to command-and-control hosts at 77[.]110[.]127[.]205 and 23[.]94[.]252[.]228. Defenders should confirm the June 2025 patch for CVE-2025-33053 is installed, block or restrict outbound WebDAV where it is not needed, disable the WebClient service on systems that do not use it, and alert on signed binaries such as iediagcmd.exe spawning child processes from unusual working directories. Because so many chains start with ClickFix-style copy-and-run prompts, teaching users to recognize that pattern remains a high-value control, as seen in recent ClickFix stealer campaigns.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.