An exposed WebDAV delivery lab shows industrialised .url/.lnk lure testing against CVE-2025-33053, with LLM-written tooling and ClickFix pages
Rapid7's managed-detection practice started from one alert — WebDAV-sourced execution via rundll32 — and pivoted to the operator's staging infrastructure, which was exposed to the internet. "It was functioning as a fully operational malware delivery lab", holding over a thousand artifacts arranged the way an engineering team arranges a test suite: 453 shortcut-based delivery launchers, 236 filename-spoofing tests, 146 tests of execution through trusted Windows tooling, 89 encrypted droppers, ClickFix pages impersonating Cloudflare, Adobe and Discord, and internal operator documentation (Rapid7, 2026-07-20). Rapid7's characterisation of the working method is the finding — "the attacker used LLMs to operate more like a modern software product team" — a line The Hacker News quotes in its own coverage (The Hacker News, 2026-07-20). The specifics behind it — generated README documentation, and bulk-produced lure variants on invoice and salary-statement themes rather than hand-crafted one-offs — are Rapid7's (Rapid7, 2026-07-20).
The technique under test is CVE-2025-33053, a flaw in how Windows resolves the working directory of a shortcut file: a legitimate, signed binary invoked through the shortcut resolves a companion file from the attacker-controlled remote WebDAV path rather than the local filesystem, so the attacker's code executes under the trusted binary's identity. The delivery side pairs WebDAV over HTTP and HTTPS with search-ms: URIs, which render a remote share as a familiar local search-results window, to invoke remote .scr executables disguised as documents. The operator's own embedded notes on the technique read "NO SmartScreen, NO MoTW warnings!" (Rapid7, 2026-07-20) — the claim being that content fetched this way never acquires the Mark-of-the-Web that would otherwise trigger the reputation and protected-view prompts users are trained on. One theme was already live rather than in testing: a national-ID-themed phishing campaign recorded 2,384 launches of a disguised .scr file delivering PureRAT to victims in Mexico.
Triage: WebDAV mounts and rundll32 executions both occur legitimately, so neither alone is the signal. The discriminating pattern is a Windows binary executing with its working directory resolved to a remote UNC or WebDAV path, particularly when the immediate parent is a shortcut invocation from a mail or browser download directory, and when the process subsequently makes outbound connections to the same remote host it loaded from. In process telemetry, correlate the remote working directory with the trusted-binary image path — an administrative script legitimately run from a file share will normally come from an internal, known server, and the discriminator is an external destination combined with a user-initiated document-open lineage.
the attacker used LLMs to operate more like a modern software product team
NO SmartScreen, NO MoTW warnings!
ATT&CK mapping
4 techniques mapped from the cited reporting · MITRE ATT&CK v19.1
Execution TA0002
T1204.002User Execution: Malicious File
An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution. This user action will typically be observed as follow-on behavior from Spearphishing Attachment. Adversaries may use several types of files that require a user to execute them, including .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, .cpl, .reg, and .iso.
T1204.004User Execution: Malicious Copy and Paste
An adversary may rely upon a user copying and pasting code in order to gain execution. Users may be subjected to social engineering to get them to copy and paste code directly into a Command and Scripting Interpreter. One such strategy is "ClickFix," in which adversaries present users with seemingly helpful solutions—such as prompts to fix errors or complete CAPTCHAs—that instead instruct the user to copy and paste malicious code.
Stealth TA0005
T1218.011System Binary Proxy Execution: Rundll32
Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: <code>rundll32.exe {DLLname, DLLfunction}</code>).
Command and Control TA0011
T1105Ingress Tool Transfer
Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp. Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer).
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.