Topic

WebDAV remote execution

Windows execution path where a library or binary is loaded over a UNC path served by a WebDAV share, so code runs from remote storage instead of a file written to the local disk.

Current clusters

security1 publisher

Talos ties a fake Google CAPTCHA to a DLL executing from a remote WebDAV share

Cisco Talos found the loader running from a WebDAV UNC path at a Ukrainian government organisation in April 2026, delivered by a ClickFix prompt whose JavaScript was stored on BNB Smart Chain. The primary payload is Amatera stealer.

Publishers:blog.talosintelligence.com

Reality

Evidence68
Adoption38
Hype gap−12
Incentives55
Confidence60