CVE-2025-33053Active Exploitation(microsoft / windows_10_1507)

Rapid7 found an exposed server holding 1,048 files of AI-generated phishing tooling. Main technique reproduces CVE-2025-33053, a WebDAV hijack Microsoft patched in June 2025, loading a malicious binary from an attacker share with no SmartScreen warning. Live campaign hits Windows users in Mexico via a fake government ID-lookup site.

Rapid7: Operator OPSEC failure exposed a full WebDAV malware delivery lab: 1,000+ files of LLM-generated lures, CVE-2025-33053 test kits, and an admin panel with hardcoded creds. Linked CURP campaign hit Mexico in June 2026, dropping PureRAT. https://www.rapid7.com/blog/post/tr-exposed-webdav-malware-delivery-lab-analysis/

An unsecured server has exposed a sophisticated phishing operation utilizing AI to enhance malware delivery via WebDAV, targeting Windows users in Mexico. The campaign exploits CVE-2025-33053, a WebDAV working-directory hijack, to execute malicious code without triggering security warnings. This incident underscores the growing integration of AI in cyberattacks, highlighting the need for robust security measures and timely patching of known vulnerabilities. #CyberSecurity #Phishing #AI #WebDAV #Malware #CVE202533053 https://thedailytechfeed.com/exposed-server-unveils-ai-assisted-phishing-toolkit-in-webdav-malware-campaign/

TRC analysis reveals attackers exploiting CVE-2025-33053 WebDAV vulnerability to deliver infostealers through fake government sites. The campaign used AI-assisted phishing toolkits to rapidly develop delivery methods, achieving lateral movement via signed Windows binaries. Runtime segmentation helps limit blast radius when attackers pivot internally. #ZeroDay #CloudSecurity 🔗 Full TRC analysis: https://aviatrix.ai/threat-research-center/exposed-server-reveals-ai-assisted-phishing-toolkit-behind-webdav-malware-campaign