Careless malware crew leaves 1,048-file toolkit exposed on the open web

Key points

• Rapid7 downloaded 1,048 files from an unsecured malware delivery server, revealing the full workflow of an active criminal operation.
• The haul included phishing lure templates, filename-spoofing tests, dropper experiments and builder notes, alongside two ready-to-run campaign chains.
• One live campaign is targeting Windows users in Mexico with an infostealer, delivered through a fake government ID-lookup site.
• The malware is served over WebDAV, a decades-old Windows file-sharing feature that lets attackers run files hosted on a remote server.
• Parts of the toolkit show clear signs of being drafted with generative AI, from lure copy to code comments.

A criminal group building malware forgot to lock its own server. Researchers at Rapid7 walked in and copied the entire workshop.

The haul, first reported by The Hacker News, runs to 1,048 files. It is not a stray sample or a leaked binary. It is the whole kit: phishing email templates, filename tricks used to disguise malicious files, experiments in how to run code quietly on a victim's machine, and notes the operators wrote to themselves while building their tools.

Two full attack chains were sitting on the server, packaged and ready to fire. One of them is already running against real people.

Who is being attacked right now?

Windows users in Mexico. The live campaign points victims to a fake website that pretends to be a Mexican government service for looking up official ID records. Anyone who lands there and clicks through gets an infostealer, which is malware designed to hoover up saved passwords, browser cookies, cryptocurrency wallets and anything else worth selling.

The delivery method leans on a piece of Windows plumbing called WebDAV. In plain terms, WebDAV lets a computer treat a folder on a remote server as if it were a local drive. Attackers like it because a file launched over WebDAV can look, to Windows, like something familiar and safe. The victim double-clicks what appears to be a document, and code runs from the attacker's server instead.

What was in the 1,048 files?

Enough to reconstruct how the crew works day to day.

There were lure templates: the fake emails and web pages used to bait victims. There were filename-spoofing tests, where the operators tried different ways to make a program file look like a PDF or an image. There were execution experiments, small trials of different techniques to launch malware without tripping antivirus. And there were droppers, small first-stage programs whose only job is to fetch the real malware once a victim is hooked.

Rapid7 also found builder notes. Reading someone else's to-do list is often more useful than reading their code.

Was AI involved?

Yes, and openly so. Several lure texts and code fragments carry the fingerprints of generative AI assistants: stock phrasing, boilerplate comments, the kind of overly tidy explanations a chatbot leaves behind. This is not a story about AI writing novel malware. It is a story about a mid-tier crew using AI the way a junior developer would, to speed up the boring parts of a criminal business.

That matters because it lowers the skill floor. A group that once needed a fluent Spanish copywriter to build a convincing Mexican government lure now needs a prompt.

What should ordinary users do?

If you are in Mexico and you searched recently for an official ID or CURP lookup, be cautious. Only use services reached through the official gob.mx domain. If you clicked through a lookalike site and downloaded anything, assume saved browser passwords are exposed: change them, starting with email and banking, and turn on two-factor authentication where you have not already.

For everyone else, the useful takeaway is smaller and duller. A file that arrives from a network location you did not choose to connect to is not a file you should open.