Careless malware crew leaves 1,048-file toolkit exposed on the open web

Key points

• Rapid7 downloaded 1,048 files from an unsecured malware delivery server, revealing the full workflow of an active criminal operation.
• The haul included phishing lure templates, filename-spoofing tests, execution experiments and builder notes, alongside two ready-to-run campaign chains.
• One live campaign is targeting Windows users in Mexico with an infostealer, delivered through a fake government ID-lookup site.
• The malware is served over WebDAV, a decades-old Windows file-sharing feature that lets attackers run files hosted on a remote server.
• Parts of the toolkit show clear signs of being drafted with generative AI, from lure copy to code comments.

A criminal group building malware forgot to lock its own server. Rapid7 walked in and copied the entire workshop.

The haul runs to 1,048 files. It's not a stray sample or a leaked binary: it's the whole kit, phishing email templates, filename tricks, experiments in how to run code quietly on a victim's machine, and notes the operators wrote to themselves while building their tools. Two full attack chains were packaged and ready to fire, and one of them is already running against real people.

Who is being attacked right now?

Windows users in Mexico. The live campaign points victims to a fake website that mimics a Mexican government service for looking up official ID records. Anyone who clicks through gets an infostealer, malware designed to hoover up saved passwords, browser cookies and anything else worth selling.

The delivery method leans on a piece of Windows plumbing called WebDAV, which lets a computer treat a folder on a remote server as if it were a local drive. Attackers like it because a file launched over WebDAV can look, to Windows, like something familiar. The victim double-clicks what appears to be a document, and code runs from the attacker's server instead. Threat Vectr first covered WebDAV abuse on 20 July 2026; this campaign shows the technique spreading further down the threat actor food chain.

Mexico has been a recurring target in our recent coverage: our 8 July story on fake CAPTCHA pages stealing from Mexican bank customers tracked a separate fraud campaign using a different social-engineering route to the same end.

What was in the 1,048 files?

Enough to reconstruct how the crew works day to day. Lure templates covered the fake emails and web pages used to bait victims. Filename-spoofing tests showed the operators trying different ways to make a program file look like a PDF or an image. Execution experiments trialled techniques to launch malware without tripping antivirus. Droppers, small first-stage programs whose only job is to fetch the real payload once a victim is hooked, were also present.

Rapid7 also found builder notes. Reading someone else's to-do list is often more useful than reading their code.

Was AI involved?

Yes, and openly so. Several lure texts and code fragments carry the fingerprints of generative AI assistants: stock phrasing, boilerplate comments, the overly tidy explanations a chatbot leaves behind. This isn't a story about AI writing novel malware. It's a story about a mid-tier crew using AI the way a junior developer would, to speed up the boring parts of a criminal business.

That matters because it lowers the skill floor. A group that once needed a fluent Spanish copywriter to build a convincing Mexican government lure now needs a prompt.

Should you worry?

If you're in Mexico and you searched recently for an official ID or CURP lookup, be cautious. Only use services reached through the official gob.mx domain. If you clicked through a lookalike site and downloaded anything, assume saved browser passwords are exposed: change them, starting with email and banking accounts, and turn on two-factor authentication where you haven't already.

For everyone else, the useful point is smaller and duller. A file that arrives from a network location you didn't choose to connect to isn't a file you should open.