A single security alert has uncovered an unusually detailed look at how attackers build, test, and deliver malware through WebDAV malware delivery infrastructure. What looked like a routine detection turned into an exposed attacker workspace containing more than 1,000 files, phishing lures, dropper tests, and operator notes.
The infrastructure targeted Windows users with fake documents, identity-themed downloads, error pages, malicious shortcuts, and ClickFix-style prompts designed to trick victims into running commands themselves.
Key Details
Rapid7 identified the server after detecting a user executing content retrieved through WebDAV with rundll32.exe. The exposed environment was not just a payload host; it functioned like a malware development and quality-assurance lab.
The directory contained 1,048 artifacts, including:
- 453 shortcut-based delivery launchers.
- 236 file-name spoofing tests.
- 146 tests involving URLs and trusted Windows tools.
- 89 encrypted droppers.
- WebDAV scripts, ClickFix pages, and internal documentation.
The actor appeared to use generative AI to speed up repetitive tasks such as lure writing, test documentation, and README creation. That suggests a campaign built for scale, not just stealth.
Technical Analysis
The campaign used several delivery paths that are common in modern Windows abuse. Victims could be pushed toward remote WebDAV shares, malicious .LNK or shortcut files, or social-engineering pages that instructed them to run commands manually.
One of the most important techniques in the lab was testing around CVE-2025-33053, a Windows shortcut flaw associated with WebDAV working-directory abuse. In practical terms, this attack pattern can make a legitimate Windows binary load a similarly named file from a remote attacker-controlled location.
The server also included decoy files that used:
- Double extensions.
- Unicode tricks.
- Right-to-left override characters.
- Misleading icons.
- Hidden command windows.
These are classic defense-evasion methods because they make malicious files appear to be normal paperwork or software artifacts.
Campaign Reach and Risks
The exposed infrastructure gave analysts a rare view of campaign scale. One lure was accessed in a way consistent with execution 2,384 times, and the server recorded 77,098 requests from 3,892 client IP addresses across 101 countries.
Mexico accounted for 82.5 percent of requests and nearly all observed launch activity, although a launch event alone does not prove successful malware execution. One observed campaign impersonated Mexico’s CURP identity lookup service and redirected victims to a fraudulent download path.
The delivered payloads included a fileless information stealer and a modular remote-access tool. They were built to collect browser credentials, cookies, wallet data, messaging sessions, screenshots, and keystrokes, while using process injection and other stealth techniques to reduce detection.
Expert Recommendations
Security teams should treat unusual WebDAV activity as a high-priority signal, especially when it follows phishing or involves trusted Windows utilities fetching remote content. The combination of WebDAV, shortcut abuse, and living-off-the-land tools is a strong indicator of hostile activity.
Recommended actions:
- Audit command lines involving
rundll32.exe,davclnt.dll,mshta.exe, and other trusted binaries. - Restrict unnecessary outbound WebDAV access.
- Block or tightly control remote shortcut execution paths.
- Train users not to follow unexpected verification or document-download prompts.
- Review logs for
search-msactivity that resolves to remote shares. - Hunt for known staging paths, suspicious
.scrfiles, and odd startup artifacts. - Validate detections against ClickFix-style social engineering flows.
Defenders should also remember that the lure is often the payload. If a user is persuaded to launch the chain manually, the malware may never need a traditional exploit.
Industry Context
This case shows how generative AI can amplify malicious operations without necessarily creating entirely new malware families. The main danger is operational efficiency: faster lure production, more delivery variants, and quicker adaptation when one path gets blocked.
It also reinforces a broader trend in malware delivery. Attackers are moving away from single static payloads and toward modular infrastructures that blend phishing, WebDAV, shortcut abuse, trusted Windows binaries, and social engineering.
That combination makes campaigns harder to detect and easier to scale across regions and industries.
Conclusion
The exposed WebDAV server shows that modern malware operations increasingly resemble software development teams, complete with testing, documentation, and iterative delivery logic. For defenders, the lesson is clear: monitor WebDAV, scrutinize trusted binary abuse, and treat user-assisted execution paths as serious attack surfaces.
FAQ SECTION
What is WebDAV malware delivery?
It is a method where attackers use WebDAV shares to host malicious files or lure victims into opening content from remote locations.
Why is rundll32.exe important here?
rundll32.exe is a trusted Windows binary often abused to execute malicious code while blending in with normal system activity.
What is CVE-2025-33053?
It is a Windows shortcut-related flaw associated with WebDAV working-directory abuse that can help attackers trigger remote file execution paths.
What is ClickFix in this context?
ClickFix is a social-engineering technique that tricks users into copying and running attacker-provided commands, often under the guise of a verification step.
What should defenders monitor first?
Look for unusual WebDAV access, search-ms traffic, suspicious shortcut files, and command lines involving trusted Windows tools.
