---
schema: 1
kind: research
title: "An exposed WebDAV delivery lab shows industrialised .url/.lnk lure testing against CVE-2025-33053, with LLM-written tooling and ClickFix pages"
headline: "1,048 artifacts on an exposed staging server show how a delivery operator now QA-tests lures like a product team"
summary: >
  Rapid7 pivoted from a single WebDAV rundll32 alert to an exposed, fully operational malware
  delivery lab holding 1,048 artifacts organised like a development workspace: 453 shortcut-based
  launchers, 236 filename-spoofing tests, 146 trusted-Windows-tool execution tests, encrypted
  droppers, ClickFix pages impersonating Cloudflare, Adobe and Discord, and LLM-generated
  operator documentation. The operator was systematically testing CVE-2025-33053 — a Windows
  shortcut working-directory resolution flaw that makes a legitimate binary load an
  attacker-supplied file from a remote WebDAV share — and its own notes claim the technique
  raises no SmartScreen or Mark-of-the-Web prompt.
discovered_at: "2026-07-26T14:05:00Z"
event_date: "2026-07-20"
run_id: 2026-07-26T1308Z-audit
priority: notable
immediate_action: null
tags: [phishing, ai-abuse, infostealer, organized-crime]
regions: [global]
sectors: [technology]
entities: []
techniques: [T1204.002, T1204.004, T1105, T1218.011]
affected_products: ["Microsoft Windows"]
cves:
  - id: CVE-2025-33053
    cvss: null
    epss: null
    type: logic-flaw
    vector: user-interaction
    auth: pre-auth
    status: [exploited, patch-available]
    affected: "Microsoft Windows (shortcut working-directory resolution) — see vendor advisory"
    fixed: "not stated in the cited research"
sources:
  - url: "https://www.rapid7.com/blog/post/tr-exposed-webdav-malware-delivery-lab-analysis/"
    publisher: "Rapid7"
    date: "2026-07-20"
    role: primary
  - url: "https://thehackernews.com/2026/07/exposed-server-reveals-ai-assisted.html"
    publisher: "The Hacker News"
    date: "2026-07-20"
    role: corroborating
closed_sources: []
evidence:
  - quote: "the attacker used LLMs to operate more like a modern software product team"
    publisher: "Rapid7"
  - quote: "NO SmartScreen, NO MoTW warnings!"
    publisher: "Rapid7, quoting the operator's own embedded documentation"
verification: multi-source
sourcing_note: "CVSS and patched-version data for CVE-2025-33053 are not stated in the cited research and are therefore left unset rather than sourced from elsewhere."
confidence: high
update_of: null
references: []
deep_dive: false
deep_dive_category: null
org_triage: null
classification:
  reliability: B
  credibility: 1
watchlist_hit: false
actions: []
migrated_from: null
---

Rapid7's managed-detection practice started from one alert — WebDAV-sourced execution via `rundll32` — and pivoted to the operator's staging infrastructure, which was exposed to the internet. "It was functioning as a fully operational malware delivery lab", holding over a thousand artifacts arranged the way an engineering team arranges a test suite: 453 shortcut-based delivery launchers, 236 filename-spoofing tests, 146 tests of execution through trusted Windows tooling, 89 encrypted droppers, ClickFix pages impersonating Cloudflare, Adobe and Discord, and internal operator documentation ([Rapid7, 2026-07-20](https://www.rapid7.com/blog/post/tr-exposed-webdav-malware-delivery-lab-analysis/)). Rapid7's characterisation of the working method is the finding — "the attacker used LLMs to operate more like a modern software product team" — a line The Hacker News quotes in its own coverage ([The Hacker News, 2026-07-20](https://thehackernews.com/2026/07/exposed-server-reveals-ai-assisted.html)). The specifics behind it — generated README documentation, and bulk-produced lure variants on invoice and salary-statement themes rather than hand-crafted one-offs — are Rapid7's ([Rapid7, 2026-07-20](https://www.rapid7.com/blog/post/tr-exposed-webdav-malware-delivery-lab-analysis/)).

The technique under test is CVE-2025-33053, a flaw in how Windows resolves the working directory of a shortcut file: a legitimate, signed binary invoked through the shortcut resolves a companion file from the attacker-controlled remote WebDAV path rather than the local filesystem, so the attacker's code executes under the trusted binary's identity. The delivery side pairs WebDAV over HTTP and HTTPS with `search-ms:` URIs, which render a remote share as a familiar local search-results window, to invoke remote `.scr` executables disguised as documents. The operator's own embedded notes on the technique read "NO SmartScreen, NO MoTW warnings!" ([Rapid7, 2026-07-20](https://www.rapid7.com/blog/post/tr-exposed-webdav-malware-delivery-lab-analysis/)) — the claim being that content fetched this way never acquires the Mark-of-the-Web that would otherwise trigger the reputation and protected-view prompts users are trained on. One theme was already live rather than in testing: a national-ID-themed phishing campaign recorded 2,384 launches of a disguised `.scr` file delivering PureRAT to victims in Mexico.

**Defender takeaway:** the volume figures matter less than what they imply about tempo. An operator that QA-tests hundreds of launcher variants against endpoint defences, and generates lure content programmatically, will iterate past a signature or a single blocked filename pattern faster than a detection-engineering cycle can respond — so the durable control here is the transport, not the artifact. Outbound WebDAV to the internet has few legitimate uses in most enterprise estates: blocking or tightly allowlisting it at the egress boundary removes the entire class, whereas chasing lure filenames does not. The same applies to the `search-ms:` handler, which is rarely needed on managed endpoints. Because the technique deliberately avoids Mark-of-the-Web, controls that depend on it — protected view, SmartScreen prompts — should not be counted on as the backstop.

**Triage:** WebDAV mounts and `rundll32` executions both occur legitimately, so neither alone is the signal. The discriminating pattern is a Windows binary executing with its working directory resolved to a remote UNC or WebDAV path, particularly when the immediate parent is a shortcut invocation from a mail or browser download directory, and when the process subsequently makes outbound connections to the same remote host it loaded from. In process telemetry, correlate the remote working directory with the trusted-binary image path — an administrative script legitimately run from a file share will normally come from an internal, known server, and the discriminator is an external destination combined with a user-initiated document-open lineage.