Loading malware…
GIFTEDCROOK is a Windows information-stealing malware family associated with the Russia-aligned threat cluster UAC-0226, also tracked as SHADOW-EARTH-066, and used in cyber-espionage operations against Ukrainian military, government, law-enforcement, and related regional entities. Early observed variants were delivered through spearphishing emails carrying macro-enabled Excel attachments, while later campaigns used weaponized WinRAR archives exploiting CVE-2025-8088 to place persistence artifacts in the Windows Startup folder and launch an obfuscated PowerShell loader. Recent variants execute primarily in memory through custom reflective loading, native NT API usage, and direct-syscall-style techniques intended to reduce file-based detection and evade user-mode security monitoring.
The malware is designed to steal browser credentials, cookies, session material, and other sensitive local data. It targets Chromium-based browsers including Chrome, Edge, and Opera, as well as Firefox, and uses Windows data-protection APIs to recover protected browser secrets. In more advanced variants, operators inject code into suspended Chromium-family browser processes to access protected material under the browser security context and bypass newer browser protections. Beyond browser theft, GIFTEDCROOK searches for and collects documents, archives, email files, VPN profiles, KeePass databases, Java KeyStores, and other potentially valuable files from common user directories and drive roots, then stages and compresses the data for exfiltration.
Exfiltration behavior evolved over time. Earlier variants sent stolen browser data to Telegram using hardcoded bot credentials, while later variants moved to encrypted HTTPS-based command-and-control and data theft workflows. Reported samples also perform cleanup, including deletion of staging artifacts and in some cases self-removal, to reduce forensic visibility. The family has been described as a direct lineage that evolved from a simpler standalone stealer into a more capable in-memory espionage tool focused on credential theft and document collection from Windows endpoints in Ukrainian target environments.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
I analyzed a UAC-0226 campaign delivering a GIFTEDCROOK stealer through a weaponized WinRAR archive... Underneath that loader sits a browser and file stealer targeting Chromium, Firefox, documents, VPN configurations, KeePass databases and other potentially sensitive material.
These are not merely oddly named files. The syntax is consistent with NTFS Alternate Data Streams combined with path traversal... CVE-2025-6218 is the related earlier WinRAR path traversal issue. Both vulnerabilities are often mentioned together, but the ADS structure visible in this archive is the distinguishing part of CVE-2025-8088. | I analyzed a UAC-0226 campaign delivering a GIFTEDCROOK stealer through a weaponized WinRAR archive... Underneath that loader sits a browser and file stealer targeting Chromium, Firefox, documents, VPN configurations, KeePass databases and other potentially sensitive material.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
I analyzed a UAC-0226 campaign delivering a GIFTEDCROOK stealer through a weaponized WinRAR archive... Underneath that loader sits a browser and file stealer targeting Chromium, Firefox, documents, VPN configurations, KeePass databases and other potentially sensitive material.
This report details a targeted cyber-espionage campaign conducted by the Russia-aligned threat actor group APT SHADOW-EARTH-066 ... delivering an updated variant of the GIFTEDCROOK information stealer against Ukrainian military and government entities.
SHADOW-EARTH-066 / UAC-0226 appears as a separate Russia-aligned campaign exploiting the same WinRAR flaw, using GIFTEDCROOK-family credential and document theft.
31 distinct techniques documented for this family, organized by ATT&CK tactic.
They both use: weaponized WinRAR archives ... PowerShell ... Click for IIM Chain { ... "name": "PowerShell", "tactic": "Execution", "technique_id": "T1059.001" }
The shortcut points to: C:\Windows\System32\cmd.exe Its arguments normalize to approximately: cmd.exe /c start /min "" ^ powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass
The script dynamically resolves the following APIs: ntdll!NtAllocateVirtualMemory ntdll!NtProtectVirtualMemory ntdll!NtCreateThreadEx ntdll!NtWaitForSingleObject ntdll!NtClose kernel32!GetExitCodeThread
this campaign weaponizes a known path traversal flaw in WinRAR (CVE-2025-8088) ... By exploiting WinRAR's NTFS Alternate Data Stream (ADS) path traversal vulnerability, the archive silently writes payload files into C:\ProgramData and drops a shortcut (.lnk) file into the Windows Startup folder
Click for IIM Chain { ... "name": "Obfuscated/Compressed Files and Information", "tactic": "Defense Evasion", "technique_id": "T1027" ... }
To evade static analysis and conceal its dependencies from traditional import table inspection, the shellcode dynamically resolves required modules like kernel32.dll using API hashing. The hashing algorithm used in this sample is: FNV-1a
The decoded data is copied into the current PowerShell process and executed at a fixed offset.
followed by an automated self-cleanup routine erasing forensic artifacts post-execution
Click for IIM Chain { ... "name": "Deobfuscate/Decode Files or Information", "tactic": "Defense Evasion", "technique_id": "T1140" ... }
The payload looks for: Login Data Cookies Network\Cookies ... Firefox ... cookies.sqlite
Underneath that loader sits a browser and file stealer targeting Chromium, Firefox, documents, VPN configurations, KeePass databases and other potentially sensitive material.
The resulting 16-byte structure is sent to: hxxps://142.111.194[.]73:8640/dj5FZEiLnA/
The malware then initializes a libcurl session and performs an HTTPS POST request with the encrypted packet as the request body.
23 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
16 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An information stealer delivered via spear-phishing and exploitation of WinRAR CVE-2025-8088. It uses a PowerShell loader and shellcode with direct/indirect syscall techniques and FNV-1a API hashing to evade EDR, establishes persistence via a Startup LNK, steals browser credentials/cookies/session data and local documents, encrypts stolen data with RC4, compresses it into ZIP archives, exfiltrates it over HTTPS to C2 infrastructure, and performs self-cleanup.
Credential-stealing malware delivered via WinRAR ADS, LNK, and obfuscated PowerShell loaders. It steals browser credentials, cookies, session files, VPN profiles, KeePass databases, and email files, stages the data in a ZIP archive, and exfiltrates it to attacker-controlled infrastructure while maintaining persistence via a startup shortcut.
Browser and file stealer used in UAC-0226 campaigns. It steals data from Chromium-based browsers and Firefox, collects documents and archives, and targets sensitive material including VPN configurations, KeePass databases, Java KeyStores, cookies, and stored credentials. In the June 2026 sample it is delivered via a weaponized WinRAR archive, staged through PowerShell, and loaded as a headerless PE with a custom reflective mapper.
Credential- and document-theft malware family used by SHADOW-EARTH-066 / UAC-0226 in espionage-oriented WinRAR exploit chains against Ukrainian organizations.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.