Hackers Abuse Windows File Explorer and WebDAV for Stealthy Malware Delivery

Cybercriminals are exploiting a legacy feature in Windows File Explorer to distribute malware by circumventing traditional web browser security and endpoint detection systems.

Threat actors leverage the Web-based Distributed Authoring and Versioning (WebDAV) protocol to deceive users into executing malicious payloads, as reported by Kahng An of the Cofense Intelligence Team.

WebDAV is an HTTP-based network protocol initially intended for remote file management. Despite Microsoft deprecating native WebDAV support in Windows File Explorer in November 2023, the feature remains accessible on most systems.

Attackers exploit this outdated support by sending links that compel File Explorer to connect directly to remote WebDAV servers. This connection bypasses web browsers, preventing standard security warnings or download prompts from appearing.

The remote server appears as a local folder, making downloaded files seem safe. Although Windows provides a default warning when executing files over a network, users familiar with legitimate enterprise file shares may ignore it.

There are three primary methods utilized by attackers to deliver this exploit, often targeting the root directory of a remote server using the DavWWWRoot keyword:

Direct Linking: Using the file:// URI scheme to open remote folders directly in the system's file browser. URL Shortcut Files (.url): Utilizing Windows UNC paths to invisibly access remote servers over HTTP or HTTPS. LNK Shortcut Files (.lnk): Containing hidden commands that download and execute malicious scripts hosted remotely.

A technical quirk in this tactic involves Windows automatically triggering a DNS lookup when a user opens a local directory containing a malicious .url file with a UNC path. This sends a TCP SYN packet to the attacker's infrastructure, alerting them that the payload is active even if the file is not clicked.

Since late 2024, the primary objective has been deploying Remote Access Trojans (RATs) for unauthorized system control. Cofense observed that 87% of Active Threat Reports (ATRs) associated with this tactic deliver multiple RATs, including XWorm RAT, Async RAT, and DcRAT.

The campaigns mainly target European corporate networks, with approximately 50% of phishing emails in German, often masquerading as financial documents, and 30% in English.

Threat actors create short-lived WebDAV servers using free Cloudflare Tunnel demo accounts on trycloudflare[.]com , routing malicious traffic through legitimate infrastructure, complicating detection efforts.

Security analysts should monitor unusual network activity from Windows Explorer and educate users to verify unfamiliar IP addresses in the File Explorer address bar. The table below lists known malicious Cloudflare Tunnel domains associated with these campaigns:

Cloudflare Tunnel Domain Associated ATR

tiny-fixtures-glossary-advantage[.]trycloudflare[.]com 374884

nasdaq-aged-sf-cheers[.]trycloudflare[.]com 377161

lose-croatia-acdbentity-lt[.]trycloudflare[.]com 377161

discounted-pressed-lc-vcr[.]trycloudflare[.]com 376309

skills-statute-alberta-demand[.]trycloudflare[.]com 376309

whats-menu-familiar-zshops[.]trycloudflare[.]com 386717

publicity-jenny-paintball-gilbert[.]trycloudflare[.]com 386717

This tactic underscores a broader risk, as similar abuses could involve other protocols like FTP and SMB.

Based on reporting by Cyber Security News.