Windows shortcut working-directory resolution flaw abused for remote WebDAV execution

An exposed WebDAV delivery lab shows industrialised .url/.lnk lure testing against CVE-2025-33053, with LLM-written tooling and ClickFix pages

Rapid7's managed-detection practice started from one alert — WebDAV-sourced execution via rundll32 — and pivoted to the operator's staging infrastructure, which was exposed to the internet. "It was functioning as a fully operational malware delivery lab", holding over a thousand artifacts arranged the way an engineering team arranges a test suite: 453 shortcut-based delivery launchers, 236 filename-spoofing tests, 146 tests of execution through trusted Windows tooling, 89 encrypted droppers, ClickFix pages impersonating Cloudflare, Adobe and Discord, and internal operator documentation (Rapid7, 2026-07-20). Rapid7's characterisation of the working method is the finding — "the attacker used LLMs to operate more like a modern software product team" — a line The Hacker News quotes in its own coverage (The Hacker News, 2026-07-20). The specifics behind it — generated README documentation, and bulk-produced lure variants on invoice and salary-statement themes rather than hand-crafted one-offs — are Rapid7's (Rapid7, 2026-07-20).

The technique under test is CVE-2025-33053, a flaw in how Windows resolves the working directory of a shortcut file: a legitimate, signed binary invoked through the shortcut resolves a companion file from the attacker-controlled remote WebDAV path rather than the local filesystem, so the attacker's code executes under the trusted binary's identity. The delivery side pairs WebDAV over HTTP and HTTPS with search-ms: URIs, which render a remote share as a familiar local search-results window, to invoke remote .scr executables disguised as documents. The operator's own embedded notes on the technique read "NO SmartScreen, NO MoTW warnings!" (Rapid7, 2026-07-20) — the claim being that content fetched this way never acquires the Mark-of-the-Web that would otherwise trigger the reputation and protected-view prompts users are trained on. One theme was already live rather than in testing: a national-ID-themed phishing campaign recorded 2,384 launches of a disguised .scr file delivering PureRAT to victims in Mexico.

Triage: WebDAV mounts and rundll32 executions both occur legitimately, so neither alone is the signal. The discriminating pattern is a Windows binary executing with its working directory resolved to a remote UNC or WebDAV path, particularly when the immediate parent is a shortcut invocation from a mail or browser download directory, and when the process subsequently makes outbound connections to the same remote host it loaded from. In process telemetry, correlate the remote working directory with the trusted-binary image path — an administrative script legitimately run from a file share will normally come from an internal, known server, and the discriminator is an external destination combined with a user-initiated document-open lineage.