AI-Assisted Phishing Toolkit Found on Exposed Server

Originally published on CyberNetSec.

Executive Summary

Researchers at Rapid7 have uncovered a misconfigured server that provided a detailed look into a modern, AI-enhanced phishing and malware operation. The exposed server, containing over 1,000 files, revealed a toolkit used by a likely Russian-speaking operator to target Windows users in Mexico. The attacker leveraged an "LLM-assisted workflow," using Large Language Models (LLMs) to generate convincing phishing content, create detailed test plans for exploits, and manage the overall campaign. The operation delivered an infostealer via a fake government ID-lookup website hosted over WebDAV. The server's admin panel, named Simba Service, was left open with default credentials, revealing a high volume of traffic. This discovery highlights a significant trend where individual cybercriminals are adopting AI to professionalize their operations and increase their efficiency.

---

Threat Overview

The discovered infrastructure reveals a cybercriminal operation that is more akin to a modern software development project than a typical ad-hoc attack. The threat actor used AI as a force multiplier for several stages of the attack lifecycle.

Key Components of the Operation:

• Target: Windows users in Mexico.
• Lure: A fake government ID-lookup website.
• Delivery Mechanism: WebDAV, a protocol that allows users to manage files on a remote web server.
• Payload: An unspecified infostealer malware, and plans for a modular .NET Remote Access Trojan (RAT).
• Management: The Simba Service admin panel to track campaign metrics.
• AI Integration: The use of LLMs (possibly an open-source agent named Coderrr) for content generation and planning.

Logs from the Simba Service panel showed that between June 20 and June 26, 2026, the server processed over 77,000 requests from nearly 3,900 unique IPs, with the vast majority originating from Mexico.

Technical Analysis

The attacker's reliance on AI is the most significant finding. This "LLM-assisted workflow" was evident in several artifacts found on the server:

• Phishing Content Generation: The text for the phishing pages was well-written and convincing, characteristic of AI-generated content. This allows attackers to overcome language barriers and create high-quality lures quickly.
• Exploit Testing and Planning: The operator maintained detailed test matrices and plans for potential exploits, structured in a way that suggests they were generated by an AI assistant. This brings a level of rigor and organization typically seen in professional QA teams.
• Code Generation: Some JavaScript code on the server showed formatting and comments (including heavy use of emojis) consistent with output from AI coding assistants like Coderrr.

Attack Chain:

1. Phishing (T1566.002): The victim is lured to the fake government website.
2. Execution via WebDAV: The victim is tricked into executing the infostealer payload delivered via the WebDAV share.
3. Credential Access (T1555): The infostealer harvests credentials from browsers, email clients, and other applications.
4. Command and Control (T1071.001): The stolen data is exfiltrated to the attacker's server.

The server also contained plans for a second campaign involving a modular .NET RAT, which would be sideloaded using a legitimate, signed binary from Ubisoft to evade detection (T1574.002 - DLL Side-Loading).

Impact Assessment

The primary impact of this operation is the theft of sensitive personal and financial information from victims in Mexico. The use of AI, however, has broader implications:

• Increased Sophistication: AI lowers the barrier for less-skilled attackers to conduct sophisticated campaigns.
• Increased Efficiency: Attackers can automate tedious tasks like content creation and testing, allowing them to launch more campaigns more quickly.
• Improved Evasion: AI can be used to generate polymorphic malware and constantly changing phishing lures, making signature-based detection less effective.

This case study provides concrete evidence of how individual threat actors are operationalizing AI, a trend that security defenders must now contend with.

IOCs — Directly from Articles

No specific file hashes, IP addresses, or domains were provided in the source articles.

Detection & Response

• Phishing Detection: Use email security gateways that can analyze for signs of AI-generated text and scan URLs for phishing indicators. (D3FEND: URL Analysis)
• Network Traffic Analysis: Monitor for connections over WebDAV to unusual or uncategorized domains. Block WebDAV traffic at the firewall if it is not required for business purposes. (D3FEND: Inbound Traffic Filtering)
• Endpoint Detection: Monitor for the execution of unsigned binaries or scripts downloaded from the internet. EDR tools can detect the behaviors of infostealers, such as accessing browser credential stores. (D3FEND: Process Analysis)
• DLL Side-Loading Detection: Monitor for legitimate, signed processes (like those from Ubisoft) loading unsigned or anomalously named DLLs from unusual directories.

Mitigation

1. User Education: Train users to be skeptical of unsolicited emails and messages, especially those that create a sense of urgency related to government services. Teach them to verify the authenticity of a website before entering credentials. (M1017 - User Training)
2. Email Security: Implement advanced email security solutions that use machine learning to detect phishing attempts.
3. Restrict WebDAV: If not essential for business, block outbound WebDAV (ports 80, 443 with PROPFIND/MKCOL methods) traffic at the network perimeter. (M1037 - Filter Network Traffic)
4. Application Control: Use application control solutions to prevent the execution of unauthorized software downloaded from the internet. (M1038 - Execution Prevention)