**AI-Powered Phishing Toolkit Exposed: A Complete Breakdown of a Reconnaissance Operation**
A significant cybersecurity incident has come to light, revealing a highly automated phishing operation that leveraged generative AI tools to rapidly develop, test, and deploy malicious campaigns. The discovery, detailed by security firm Rapid7, offers a rare, real-time glimpse into the “development trail” of a sophisticated cyberattack.
### The Exposed Arsenal: More Than Just Malware
The story begins with a misconfigured server belonging to a malware operator. This oversight allowed the cybersecurity firm Rapid7 to download a massive trove of data, comprising 1,048 files. This wasn’t just a collection of malicious executables; it was a complete digital workshop. The haul included:
* **Lure Templates:** Documents designed to trick users.
* **Filename-Spoofing Tests:** Experiments to evade detection by making files appear harmless.
* **Execution Experiments:** Prototypes of attack methods.
* **Droppers & Builder Notes:** Core components and instructions for building further attacks.
* **Two Campaign Chains:** Fully mapped-out attack sequences.
What makes this discovery so valuable to defenders is that it captured the operation “mid-build.” The server contained not just the final malware, but the entire development process, including testing notes, failed experiments, documentation, and live logs. This is a level of insight rarely available to security teams.
### The AI Operator: Speed and Automation
Rapid7’s analysis of the contents, down to a hardcoded path pointing to an open-source AI coding tool, led to a critical conclusion: **the operator was using generative AI to produce, test, and document their phishing attack at machine speed.** The operation is attributed to an AI-assisted workflow, likely utilizing a tool codenamed “CodeRRR” (named after a public, open-source AI coding agent). The attacker’s README files were even written in a templated, emoji-heavy style consistent with LLM (Large Language Model) output.
This represents a paradigm shift in cybercrime. Attackers are no longer just writing code; they are managing AI agents that write, test, and document code for them, turning phishing into a product-like pipeline.
### The Core Attack: Hijacking a Windows Feature (CVE-2025-33053)
The most developed and significant attack chain in the toolkit exploited a vulnerability designated **CVE-2025-33053 (CVSS 8.8)**. This flaw is so critical it is now listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog. It was originally documented by Check Point in late 2025.
**How the Attack Worked:**
1. **The Lure:** Victims were directed to a fake government ID-lookup website (a typosquat of `gobf.mx`, mimicking a Mexican government portal).
2. **The Trigger:** A download button on the fake site initiated a `search-ms:` protocol query.
3. **The Hijack:** This query exploited a Windows feature to open a WebDAV share. The attacker’s `.url` shortcut file was cleverly configured to launch a legitimate, signed Windows binary—`iediagcmd.exe` (an Internet Explorer diagnostics tool).
4. **The Payload:** Due to the vulnerability, Windows would load a malicious `route.exe` file not from the secure `System32` directory, but from the attacker-controlled WebDAV share. This allowed the attacker to hijack the execution flow.
5. **The Result:** The malicious `route.exe` would then load a .NET infostealer directly into memory, leaving minimal forensic evidence. The operator boasted this could be done “WITHOUT any security warnings. Zero alerts!”
Microsoft patched this vulnerability in June 2025, but the discovery shows how quickly weaponization can follow a patch.
### A Scalable and Adaptive Toolkit
While the `iediagcmd.exe` path was the primary focus, the operator had built a comprehensive and adaptable kit:
* **Scale:** One “comprehensive test kit” contained 59 separate `.url` files, each targeting different signed Windows binaries like `.NET` tools (`InstallUtil`, `RegAsm`), other LOLBAS (Living Off The Land Binaries and Scripts) entries, and potential UAC bypass candidates.
* **Testing Methodology:** Each `.url` file came with written notes analyzing why the attack *should* work and a tiered testing order. The operator treated these as hypotheses to be probed one by one, not guaranteed exploits.
* **Adaptability:** The original trick fails on Windows 11 24H2 because `iediagcmd.exe` is no longer present. The toolkit included smaller test sets for two other flaws (`CVE-2026-21513` and `CVE-2025-24054`), showing a prepared and adaptable attacker ready to pivot to the next vector.
### The Tell: Amateurish OpSec
Despite the sophistication of the tooling, the operator made critical mistakes in operational security (OpSec):
* **Templated Documentation:** The READMEs, test matrices, and lure-generation guides used a distinctive, verbose, and emoji-heavy formatting that Rapid7 associates with LLM-generated text.
* **Russian Context:** Folder names like `testik` (a diminutive of “test”) and comments in Russian were found, placing the operator in a Russian-speaking context, though their specific identity remains unknown.
* **Exposed Infrastructure:** The operator carelessly left a management panel called “Simba Service” on the same server with its default port and credentials unchanged.
An active campaign targeting Mexican users was traced back to the infrastructure, with a single CURP lure accounting for 97.7% of all launch events over a 5.5-day period. The activity data suggested the reach was broad (3,892 unique IPs across 101 countries) but the conversion to actual victims was concentrated in Mexico during working hours.
### Conclusion: The Enduring Threat of AI-Aided Phishing
While the specific server was discovered and the original campaign has cooled, the method it revealed is here to stay. This operation was not defined by a lone genius hacker, but by an operator who wired together off-the-shelf AI coding tools into a repeatable industrial pipeline for creating and testing phishing attacks.
For defenders, the key takeaways are clear:
1. **The tooling is evolving fast:** Defenses must also automate and use AI to keep pace with AI-powered attacks.
2. **Behavior is the key indicator:** Technical indicators and hashes can be blocked, but the underlying malicious behaviors—like a signed binary loading code from a remote share—remain the most reliable detection method.
3. **The attack surface is vast:** With 59 potential targets identified from a single operator, the hunt for other signed binaries with similar quirks is an ongoing arms race.
The exposed toolkit is a stark warning: the future of phishing is automated, AI-driven, and more dangerous than ever.
—
### FAQ
**Q: What is the name of the malware operator or group responsible?**
A: The operator’s identity remains unknown. They are referred to by the security firm Rapid7, and their server was misconfigured, leading to the exposure.
**Q: Which specific AI tool did the operator use?**
A: The exact tool is not named, but its traces point to an open-source AI coding agent, with `Coderrr` (CodeRRR) being the specific agent Rapid7 attributes the operation to. It’s described as a general-purpose, open-source tool inspired by agents like Claude Code and GitHub Copilot CLI.
**Q: How did the attackers deliver the malware?**
A: The primary delivery method was a typosquatted website (`gobf.mx`), designed to look like a Mexican government CURP ID-lookup page. Clicking a button triggered a malicious `search-ms` protocol handler, which exploited a WebDAV path hijacking vulnerability to execute a payload.
**Q: Is this attack still active?**
A: The specific, massive delivery burst observed by Rapid7 was short-lived, occurring from June 20 to 26, 2026, and cooled down after June 24. However, the toolkit and the method it reveals remain a threat, and defenders are warned to watch for similar campaigns.
**Q: What can I do to protect myself?**
A:
* **Patch Immediately:** Ensure all systems, especially Windows, are fully patched. The specific vulnerability (CVE-2025-33053) has been patched since June 2025.
* **Be Suspicious:** Be wary of unexpected emails, messages, or links, especially those creating a sense of urgency (e.g., fake government notices).
* **Check for Typosquatting:** Carefully inspect URLs for subtle misspellings.
* **Monitor for Suspicious Behavior:** Watch for signs like `winword.exe` or `svchost.exe` spawning child processes with paths located on a WebDAV share or a removable drive.
### Conclusion
This incident marks a significant moment in the evolution of cybercrime. It moves beyond simple phishing emails to a model of industrialized, AI-assisted development. The exposed server provided an unprecedented look at the entire lifecycle of an attack—from failed experiments to a deployable weaponized kit. The primary lesson for the security community is clear: the barrier to creating sophisticated, automated attacks has never been lower, and defenders must adopt similar levels of automation and vigilance to counter this new reality.
