Fileless stealer and PureRAT operators are abusing a WebDAV‑backed “malware delivery lab” to raid browser passwords, Telegram sessions, and cryptocurrency wallets in a campaign that blends fileless info‑stealing with a modular .NET RAT.
The incident began with an MDR alert tied to a user executing content retrieved from a WebDAV server via rundll32.exe, with telemetry showing WebClient and davclnt.dll fetching remote resources.
Pivoting from that alert led investigators to an exposed directory that turned out to be a fully functional malware delivery and QA lab, not merely a payload drop.
The infrastructure hosted 1,048 artifacts clustered across LNK launchers, filename‑spoofing tests, URL/LOLBin execution trials, encrypted droppers, alternative containers (search-ms, library-ms, .cpl), WebDAV initialization scripts, ClickFix HTML lures, and detailed operator notes.
This layout made it possible to reconstruct not just individual campaigns but the attacker’s entire delivery workflow end‑to‑end.
The open directory showed attackers working like a software product team, segmenting payloads, delivery methods, and QA folders for browser and Explorer rendering tests.
They systematically evaluated Unicode spoofing, RTLO characters, double extensions, padding tricks, and multiple Windows‑trusted binaries as LOLBins in WebDAV‑style execution paths.
Several folders referenced specific vulnerabilities, including CVE‑2025‑33053 (Windows Internet Shortcut working‑directory hijack), CVE‑2026‑21513 (MSHTML security feature bypass), and CVE‑2025‑24054 (NTLM spoofing via crafted path handling).
The most mature test set focused on CVE‑2025‑33053, reproducing Stealth Falcon tradecraft by abusing .url files and iediagcmd.exe to redirect child process resolution to attacker‑controlled WebDAV shares.
The directory was saturated with structured README files, test kits, lure‑generation guides, and matrix‑style outputs that strongly resemble LLM‑generated documentation.
Artifacts included a “Working Directory Hijacking Comprehensive Test Kit” with 59 .url hijack candidates, prioritized testing tiers, and a clear theory of success criteria, all presented in polished, templated prose with emojis and bilingual sections.
Build artifacts pointed to an LLM‑assisted workflow built around the CodeRRR project, with PowerShell generators (generate_test_lnk.ps1), _MAPPING.csv files.
Rapid7 Researchers said that, the operation shows how generative AI is being weaponized to industrialize lure generation, QA delivery pipelines, and exploit testing at scale.
Lure themes skewed toward enterprise‑friendly documents contracts, invoices, salary statements, Labcorp reports, privacy policies and were heavily optimized for perceived safety through fake icons, RTLO spoofing, and minimized or hidden windows.
Fileless Stealer and PureRAT Raid Browser
ClickFix HTML lures masqueraded as Cloudflare checks, Adobe or Word errors, Microsoft login prompts, Chrome update notices, and Discord notifications, instructing users to copy‑paste commands that invoked PowerShell, cmd.exe, rundll32, or mshta against WebDAV/UNC paths.
The Simba Service admin panel sat on top of a read‑only WebDAV share, instrumented to track file opens, visitor IPs, geolocation, Windows versions, traffic volume, errors, and folder‑level conversion metrics in near real time.
Its bot/scanner detection logic scored IPs based on 404 patterns, directory enumeration, and WebDAV probes, giving operators a UI to block suspected security tooling.
In one major campaign, the attackers deployed a curated phishing site impersonating Mexico’s CURP ID‑lookup portal (www[.]gobf[.]mx), fronting a single‑page application that requested national‑ID data.
When victims clicked “download,” client‑side JavaScript issued a search-ms: URI that opened a WebDAV share view filtered to .scr files specifically a RTLO‑spoofed ReportFinal.rcs.pdf executable.
That binary, packaged via Delphi/Inno Setup, unpacked a loader (Fo-Binary.exe) that decrypted an embedded .NET stealer using AES and GZip, then reflectively loaded it into memory via Assembly.Load(byte[]) before injecting it into an EV‑signed Qihoo 360 process through process hollowing.
The result was a fully fileless infostealer whose in‑memory config (version 4.4.3, tagged 06x12x2026SantaEbash2) targeted around 20 desktop wallets and browser extensions, browser credentials and cookies, Telegram tdata sessions, Foxmail data, and desktop screenshots.
Anti‑analysis logic checked COR_PROFILER and IsDebuggerPresent, invoking FailFast when instrumentation was detected, and deferred decrypting its watchlist and collection profile until after a successful C2 handshake.
Exfiltration used SslStream without SNI and raw sockets to POST multipart data to 77[.]110.127.205 (google.services.ug) at /c2, further complicating traditional network‑based detection.
Presentation‑style HTML describing the Simba Service WebDAV panel’s architecture, APIs, and operational guidance. This evidences a shift from manual, ad‑hoc tradecraft toward AI‑accelerated, pipeline‑driven malware engineering.
A second chain, staged under a DlrtyGames directory, exemplified DLL sideloading and modular RAT deployment. It began with a silent 7‑Zip SFX (DlrtyGames.exe) that dropped a benign Ubisoft binary (Volt_Droid.exe) plus a trojanized discord-rpc.x64.dll, leveraging sideloading to bootstrap the next stage.
The malicious DLL decoded its config, resolved APIs by hash, mapped profiler16.dll, and then parsed loader-pool.db a PNG whose IDAT chunks hid encrypted modules before reassembling and decrypting content after a 45‑second delay, setting persistence, abusing COM auto‑elevation via dllhost.exe, and preparing an x86 process‑hollowing stage.
That PIC shellcode spawned signed host processes (MegArray.exe, Crisp.exe), unmapped them, and replaced their image with a .NET‑based PureRAT payload connected to a C2 at 23[.]94[.]252[.]228:57666.
PureRAT’s modular architecture provided plugins for keylogging, screenshots, window monitoring, and C2 operations, tuned to financial and crypto‑related activity (banking, payments, wallets, seed phrases) and browser wallets.
Combined with the fileless stealer chain, the operation effectively pivoted from initial data theft into full remote access, persistence, and continuous session hijacking.
WebDAV telemetry over a 5.5‑day window (June 20–26, 2026 UTC) recorded 77,098 requests from 3,892 client IPs across 101 countries, transferring roughly 45.9 GB of data.
Mexico accounted for 82.5% of all requests and 96.9% of launch events, with the CURP‑themed ReportFinal.rcs.pdf lure responsible for 97.7% of executable launches and around 14.6 GB of outbound traffic.
Traffic peaks between 16:00 and 19:00 UTC aligned with business hours in central Mexico, suggesting real user interaction rather than purely automated scanning.
While not every launch event equals successful execution, the telemetry strongly indicates a focused campaign against Mexican users and organizations, with broader global traffic reflecting scanners, research activity, and opportunistic exposure.
Defenders should treat WebDAV‑ and search-ms‑driven delivery as high‑risk, applying strict controls on rundll32, mshta, bitsadmin, certutil, and other LOLBins frequently surfaced in this lab’s test matrix.
Patching CVE‑2025‑33053 and related working‑directory hijack vectors, hardening NTLM, and monitoring .url shortcuts invoking unexpected binaries are critical to closing the hijack paths exploited here.
More broadly, this campaign illustrates that the combination of fileless stealers and PureRAT‑style backdoors, when paired with AI‑generated documentation and QA pipelines, allows adversaries to iterate faster than traditional signature‑based defenses can adapt.
Security teams should pair exposure management with behavior‑focused detection, including telemetry on WebDAV use, search-ms invocation, in‑memory .NET loading, and anomalous TLS without SNI, to catch the delivery pipeline rather than just its latest payload.
IOCs
| Category | Value |
|---|---|
| Phishing Page | hxxps://gobf[.]mx |
| WebDAV Server | onedrive[.]cv |
| Malware File | ReportFinal.<RLO>.scr |
| SHA256 | 04A8018191F2E9E76072D072A933371D9D669A42DE2B2A087541CD3A653B0BA7 |
| C2 IP Address | 77.110.127.205 |
| C2 Ports | 56001–56003, 57666, 57777, 57888 |
| Malicious Domain | google.services[.]ug |
| Campaign Tag | 06x12x2026SantaEbash2 (v4.4.3) |
| Scheduled Tasks | brokerhost, net_queue_32 |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
𝗔𝗜 𝗦𝗢𝗖 𝘃𝘀 𝗠𝗗𝗥 𝘃𝘀 𝗠𝗦𝗦𝗣 Which is Best in 2026? Compare costs, Automation, and response: Download Free Guide
