Ptechhub
  • News
  • Industries
    • Enterprise IT
    • AI & ML
    • Cybersecurity
    • Finance
    • Telco
  • Brand Hub
    • Lifesight
  • Blogs
No Result
View All Result
  • News
  • Industries
    • Enterprise IT
    • AI & ML
    • Cybersecurity
    • Finance
    • Telco
  • Brand Hub
    • Lifesight
  • Blogs
No Result
View All Result
PtechHub
No Result
View All Result

GIFTEDCROOK Malware Evolves: From Browser Stealer to Intelligence-Gathering Tool

The Hacker News by The Hacker News
June 28, 2025
Home Cybersecurity
Share on FacebookShare on Twitter


Jun 28, 2025Ravie LakshmananMalware / Cyber Warfare

The threat actor behind the GIFTEDCROOK malware has made significant updates to turn the malicious program from a basic browser data stealer to a potent intelligence-gathering tool.

“Recent campaigns in June 2025 demonstrate GIFTEDCROOK’s enhanced ability to exfiltrate a broad range of sensitive documents from the devices of targeted individuals, including potentially proprietary files and browser secrets,” Arctic Wolf Labs said in a report published this week.

“This shift in functionality, combined with the content of its phishing lures, […] suggests a strategic focus on intelligence gathering from Ukrainian governmental and military entities.”

GIFTEDCROOK was first documented by the Computer Emergency Response Team of Ukraine (CERT-UA) in early April 2025 in connection with a campaign targeting military entities, law enforcement agencies, and local self-government bodies.

Cybersecurity

The activity, attributed to a hacking group it tracks as UAC-0226, involves the use of phishing emails containing macro-laced Microsoft Excel documents that act as a conduit to deploy GIFTEDCROOK.

An information stealer at its core, the malware is designed to steal cookies, browsing history, and authentication data from popular web browsers such as Google Chrome, Microsoft Edge, and Mozilla Firefox.

Arctic Wolf’s analysis of the artifacts has revealed that the stealer started off as a demo in February 2025, before gaining new features with versions 1.2 and 1.3.

These new iterations include the ability to harvest documents and files below 7 MB in size, specifically looking for files created or modified within the last 45 days. The malware specifically searches for the following extensions: .doc, .docx, .rtf, .pptx, .ppt, .csv, .xls, .xlsx, .jpeg, .jpg, .png, .pdf, .odt, .ods, .rar, .zip, .eml, .txt, .sqlite, and .ovpn.

The email campaigns leverage military-themed PDF lures to entice users into clicking on a Mega cloud storage link that hosts a macro-enabled Excel workbook (“Список оповіщених військовозобов’язаних організації 609528.xlsm”), causing GIFTEDCROOK to be downloaded when the recipient turns on macros. Many users don’t realize how common macro-enabled Excel files are in phishing attacks. They slip past defenses because people often expect spreadsheets in work emails—especially ones that look official or government-related.

The captured information is bundled into a ZIP archive and exfiltrated to an attacker-controlled Telegram channel. If the total archive size exceeds 20 MB, it is broken down into multiple parts. By sending stolen ZIP archives in small chunks, GIFTEDCROOK avoids detection and skips around traditional network filters. In the final stage, a batch script is executed to erase traces of the stealer from the compromised host.

Cybersecurity

This isn’t just about stealing passwords or tracking online behavior—it’s targeted cyber espionage. The malware’s new ability to sift through recent files and grab documents like PDFs, spreadsheets, and even VPN configs points to a bigger goal: collecting intelligence. For anyone working in public sector roles or handling sensitive internal reports, this kind of document stealer poses a real risk—not just to the individual, but to the entire network they’re connected to.

“The timing of the campaigns discussed in this report demonstrates clear alignment with geopolitical events, particularly the recent negotiations between Ukraine and Russia in Istanbul,” Arctic Wolf said.

“The progression from simple credential theft in GIFTEDCROOK version 1, to comprehensive document and data exfiltration in versions 1.2 and 1.3, reflects coordinated development efforts where malware capabilities followed geopolitical objectives to enhance data collection from compromised systems in Ukraine.”

Found this article interesting? Follow us on Twitter  and LinkedIn to read more exclusive content we post.





Source link

Tags: computer securitycyber attackscyber newscyber security newscyber security news todaycyber security updatescyber updatesdata breachhacker newshacking newshow to hackinformation securitynetwork securityransomware malwaresoftware vulnerabilitythe hacker news
The Hacker News

The Hacker News

Next Post
FBI Warns of Scattered Spider’s Expanding Attacks on Airlines Using Social Engineering

FBI Warns of Scattered Spider's Expanding Attacks on Airlines Using Social Engineering

Recommended.

Inside the Mind of the Adversary: Why More Security Leaders Are Selecting AEV

Inside the Mind of the Adversary: Why More Security Leaders Are Selecting AEV

June 6, 2025
Insurers ramp up AI adoption — cautiously

Insurers ramp up AI adoption — cautiously

June 30, 2025

Trending.

⚡ Weekly Recap: Oracle 0-Day, BitLocker Bypass, VMScape, WhatsApp Worm & More

⚡ Weekly Recap: Oracle 0-Day, BitLocker Bypass, VMScape, WhatsApp Worm & More

October 6, 2025
Cloud Computing on the Rise: Market Projected to Reach .6 Trillion by 2030

Cloud Computing on the Rise: Market Projected to Reach $1.6 Trillion by 2030

August 1, 2025
Stocks making the biggest moves midday: Autodesk, PayPal, Rivian, Nebius, Waters and more

Stocks making the biggest moves midday: Autodesk, PayPal, Rivian, Nebius, Waters and more

July 14, 2025
The Ultimate MSP Guide to Structuring and Selling vCISO Services

The Ultimate MSP Guide to Structuring and Selling vCISO Services

February 19, 2025
Translators’ Voices: China shares technological achievements with the world for mutual benefit

Translators’ Voices: China shares technological achievements with the world for mutual benefit

June 3, 2025

PTechHub

A tech news platform delivering fresh perspectives, critical insights, and in-depth reporting — beyond the buzz. We cover innovation, policy, and digital culture with clarity, independence, and a sharp editorial edge.

Follow Us

Industries

  • AI & ML
  • Cybersecurity
  • Enterprise IT
  • Finance
  • Telco

Navigation

  • About
  • Advertise
  • Privacy & Policy
  • Contact

Subscribe to Our Newsletter

  • About
  • Advertise
  • Privacy & Policy
  • Contact

Copyright © 2025 | Powered By Porpholio

No Result
View All Result
  • News
  • Industries
    • Enterprise IT
    • AI & ML
    • Cybersecurity
    • Finance
    • Telco
  • Brand Hub
    • Lifesight
  • Blogs

Copyright © 2025 | Powered By Porpholio