Cybersecurity: Exposed server uncovers AI-powered phishing kit

The vulnerability behind the AI-powered phishing kit

In an unexpected turn for cybersecurity, a malware operator made a critical mistake: they left their delivery server completely exposed. Researchers at Rapid7 managed to access and dismantle an entire arsenal consisting of 1,048 files, ranging from lure templates to phishing tools and sophisticated droppers.

This finding is significant not only due to the volume of data recovered but also because of the integration of Artificial Intelligence in the creation of malware and the automation of campaigns. This level of sophistication is reminiscent of tactics observed in recent incidents, such as UAC-0145: The dangerous hack using ClickFix to infect systems, where social engineering is combined with technical vulnerabilities to deceive users.

Analysis of an active campaign in Mexico

The server analysis revealed two distinct infection chains. One of them was already operational, actively targeting Windows users in Mexico. The attack method used a fake website that mimicked a government ID inquiry portal. Through the WebDAV protocol, the attackers managed to deploy an infostealer designed to extract credentials and sensitive data from compromised machines.

"AI-driven automation allows attackers to scale their operations with minimal effort, creating highly convincing lures that bypass traditional defenses."

Why is this a greater risk?

What differentiates this campaign from other conventional hack attempts is the meticulousness with which the attackers experimented with file execution. The kit contained:

• Detailed notes on malware construction.
• Tests for filename spoofing.
• Execution experiments to evade security solutions.

Although the primary objective in this case was information theft, the discovered infrastructure demonstrates that threat actors are refining their techniques to facilitate higher-impact attacks, such as large-scale ransomware deployment. The ability to automate the creation of lures via AI means that the volume of attacks could increase exponentially in the coming months.

Conclusion

The exposure of this server is a tactical victory, but also a warning. The barrier to entry for launching complex phishing attacks has dropped drastically thanks to AI. For organizations and end users, the lesson is clear: perimeter-based security is no longer sufficient against threats that learn and evolve in real time.

---

Sources: The Hacker News (2026/07): Exposed Server Reveals AI-Assisted Phishing Toolkit Behind WebDAV Malware Campaign.