What Is GIFTEDCROOK Malware and How Has It Evolved into a Major Cyber Espionage Tool in 2025?

Key takeaways

• It is described as an information stealer with a focus on documents and VPN profiles.
• Avoid opening attachments from unknown senders.
• Check the vendor report for indicators.

Table of Contents

• What Is GIFTEDCROOK and Who Runs It?
• How Did GIFTEDCROOK’s Capabilities Expand in 2025?
• GIFTEDCROOK Version Evolution (Feb–Jun 2025)
• How Does the Infection Chain Work?
• Who Is Being Targeted, and Why?
• What Makes GIFTEDCROOK Hard to Detect?
• How Can Organizations Defend Against GIFTEDCROOK?
• What’s Next for GIFTEDCROOK?

The GIFTEDCROOK malware, originally a proof‑of‑concept browser stealer, has rapidly morphed into a sophisticated intelligence‑gathering tool aligned with the Ukraine–Russia conflict. Recent June 2025 campaigns show it harvesting documents, images, VPN profiles, and more from Ukrainian government and military networks.‍

What Is GIFTEDCROOK and Who Runs It?

GIFTEDCROOK is linked to the threat cluster UAC‑0226, a group first flagged by CERT‑UA in April 2025 for phishing Ukraine’s military and law‑enforcement agencies with macro‑enabled Excel lures.‍The malware’s operators rely on:

• Military‑themed phishing emails that appear official.

• Macro‑laced Excel workbooks hosted on cloud drives (e.g., Mega).

• Telegram channels for exfiltrating stolen ZIP archives and issuing commands.

How Did GIFTEDCROOK’s Capabilities Expand in 2026?

Early 2025: Version 1 (Proof‑of‑Concept)

• Stole cookies, browsing history, and saved credentials from Chrome, Edge, Firefox.

• Exfiltrated data to Telegram in single ZIP payloads.

June 2025: Versions 1.2 & 1.3

• Added file‑system harvesting: grabs any file ≤ 7 MB created/modified in last 45 days.

• Targeted extensions: .doc,.pdf,.xlsx,.jpeg,.ovpn,.sqlite,.zip and more.

• Split archives > 20 MB into parts to dodge network filters.

• Executes a self‑delete batch script to wipe traces post‑exfiltration.‍

 GIFTEDCROOK Version Evolution (Feb–Jun 2025)

How Does the Infection Chain Work?

1. Phishing Email: Military‑style PDF lure with link to cloud‑hosted Excel (.xlsm).

2. Macro Execution: Victim enables macros; embedded VBA downloads GIFTEDCROOK to %AppData%.

3. Stealing Phase: Malware enumerates browsers, then scans documents < 7 MB.

4. Packaging & Exfil: Data zipped, chunked, and pushed to adversary’s Telegram bot.

5. Self‑Deletion: Batch script wipes binaries and logs to hinder forensic recovery.

Why it evades defenses: Many organizations still allow macro‑enabled Office docs in email workflows, and Telegram traffic often blends into normal encrypted traffic.

Who Is Being Targeted, and Why?

Arctic Wolf notes a strategic pivot toward Ukrainian governmental and military entities. The timing of campaigns coincides with high‑profile negotiations and troop movements, suggesting state‑aligned espionage motives.‍(arcticwolf.com) Stealing VPN configs (.ovpn) and recent office docs indicates a goal of reading internal briefs, operational plans, and secure‑communications details.

What Makes GIFTEDCROOK Hard to Detect?

• Cloud Storage Delivery: Legitimate providers like Mega reduce reputation‑block effectiveness.

• Telegram C2: Encrypted messaging APIs skirt traditional proxy blocks.

• File‑Size & Date Filters: Keeps payload small and relevant, minimizing noise.

• Self‑Wipe Routine: Removes artifacts before EDR can collect evidence.

How Can Organizations Defend Against GIFTEDCROOK?

1. Disable or Strictly Sign Macros

Block unsigned macros by default; use Office Protected View for files from the internet.

2. Monitor Cloud‑Storage Links

Flag outbound requests to file‑sharing sites in phishing emails; sandbox downloads automatically.

3. Inspect Telegram Traffic

If Telegram isn’t business‑critical, proxy‑block its API domains; otherwise, DLP‑scan encrypted channels.

4. Enforce Least‑Privilege & EDR

Limit local admin rights; deploy EDR to flag unusual ZIP creation and Telegram command traffic.

5. Train High‑Risk Users

Warn military and government staff about macro‑enabled Excel threats and cloud‑hosted lures.

What’s Next for GIFTEDCROOK?

Given its modular design, future versions may:

• Use geofenced commands to target other conflict zones.

• Integrate screen‑capture or keylogging plug‑ins.

• Shift to peer‑to‑peer C2 if Telegram channels are blocked.

Keeping visibility on file exfiltration patterns and tightening controls around macro execution remain top mitigation steps for 2025.

To take this further with guided labs and an instructor, see our EC-Council CSA certification programme.

Related reading

• What is the APT36 BOSS Linux attack and how are weaponized ZIP files used to compromise systems?
• What Is Fileless Malware and How to Detect It Effectively | The Silent Threat
• Kimsuky Hackers Use ClickFix Social Engineering to Deploy Malware via PowerShell | Full Analysis 2026

Reference

For the authoritative details, see MITRE ATT&CK.