Loading story…
Researchers linked a GIFTEDCROOK stealer campaign associated with UAC-0226 to a misconfigured Apache server that exposed thousands of malware staging files. Analysis of the infrastructure uncovered 3,788 files in an open directory, including 947 each of LNK files, VBS scripts, PowerShell scripts, and PDF decoys, indicating an automated distribution pipeline. The infection chain used a compressed archive to deliver a shortcut file that launched a VBS script, displayed a benign refund-form PDF in Microsoft Edge as a decoy, and retrieved a PowerShell payload from refundonex[.]com before beaconing to a tracking API endpoint with a static key.
The PowerShell stage was designed to frustrate analysis by running with execution-policy bypass and reconstructing its final payload at runtime. Embedded AES key and IV values were used to decrypt Base64-encoded chunks into a larger script, which was then executed via Invoke-Expression; separate reporting on the same activity described the operation as a GIFTEDCROOK stealer sample tied to UAC-0226 and highlighted how low-effort obfuscation and exposed hosting infrastructure enabled broad malware distribution while complicating static detection.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
The published analysis described the campaign’s execution flow: a VBS script opened a refund-form PDF decoy in Edge, downloaded a PowerShell payload from refundonex[.]com, executed it with ExecutionPolicy Bypass, and contacted a tracking API endpoint using a static key. It also revealed the PowerShell payload reconstructed encrypted script chunks at runtime with embedded AES keying material and executed them via Invoke-Expression.
Robin Dost published analysis of a stealer campaign after investigating a malicious LNK sample and finding a misconfigured Apache server exposing 3,788 auto-generated files. The archive included 947 each of LNK, VBS, PowerShell, and PDF decoy files, showing a scaled infection chain from RAR to VBS to PS1.
Synaptic Security published research detailing how obfuscation used in a UAC-0226 GIFTEDCROOK stealer sample could be broken down and analyzed. This indicates technical details of the malware’s implementation were publicly revealed by that date.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
blog.synapticsystems.de
Open sourceblog.synapticsystems.de
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that **UAC-0226** deployed the **GIFTEDCROOK** stealer through weaponized WinRAR archives that abused **Alternate Data Streams (ADS)** and path traversal to hide malicious content and place a `.lnk` file in the Windows Startup folder. The shortcut launched an obfuscated PowerShell loader, waited briefly, decoded a staged payload stored in `C:\ProgramData`, and reflectively mapped a headerless PE image into memory using native Windows APIs, giving the malware persistence while reducing file-based detection. The lure document was themed around Ukrainian reconnaissance and UAV personnel, indicating targeting aligned with Ukrainian military-related users. Once loaded, GIFTEDCROOK harvested data from **Chromium browsers**, **Firefox**, documents, archives, VPN profiles, **KeePass** databases, Java KeyStores, email files, cookies, credentials, and session data before staging and compressing the stolen information for exfiltration. Researchers said the updated chain expands earlier UAC-0226 tradecraft with automatic Startup persistence, hidden archive content, a custom PE format, reflective DLL loading, and execution telemetry sent to attacker-controlled infrastructure including `142.111.194[.]73:8640`, while retaining PowerShell-based obfuscation and in-memory execution techniques.
Jun 29, 2026
Researchers uncovered an exposed attacker-controlled server that revealed the full workflow behind a WebDAV phishing operation delivering malware through Windows shortcut and signed-binary execution chains. The infrastructure held **1,048 artifacts** including phishing lures, testing notes, admin-panel files, delivery analytics, and documentation that suggested the operator used generative AI tooling to build content and test matrices at scale. The most active campaign impersonated Mexico’s **CURP** identity-record service through the typosquatted domain `gobf[.]mx`, used a WebDAV share on `onedrive[.]cv`, and abused **`CVE-2025-33053`**, a Windows working-directory hijack flaw previously linked to Stealth Falcon activity, to launch a disguised payload posing as a PDF report. The recovered files showed the actor testing **59** `.url` shortcut variants against multiple signed Windows binaries, likely adapting after the original `iediagcmd.exe` technique became less effective on Windows 11 24H2. One infection chain delivered a fileless in-memory **.NET infostealer** that exfiltrated data to `77.110.127.205`, while a second campaign, tracked as **DlrtyGames**, used a 7-Zip SFX dropper, DLL sideloading via a signed Ubisoft binary, IDAT-carried payloads, process hollowing, and persistence to deploy the modular **PureRAT** malware communicating with `23.94.252.228:57666`. Delivery logs from the exposed Simba Service panel recorded **77,098 requests** from **3,892 unique IPs** across **101 countries** over roughly 5.5 days, with activity heavily concentrated in Mexico.
Jul 30, 2026
Researchers detailed a **MetaStealer** infection chain delivered through malicious email attachments and links, including Excel macro documents and OneNote files, that infected Windows systems and established persistence for follow-on payload delivery. In the observed campaigns, enabling macros or opening the lure file launched scripts that retrieved components from **GitHub** and **transfer.sh**, built a persistent executable on the host, and modified `HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell` so the malware would restart after reboot. Analysts said the infrastructure remained active near the time of publication, and network traffic to `193.106.191.162:1775` matched **EmergingThreats Pro** detections for Win32/MetaStealer activity. Separate reverse engineering showed MetaStealer used **XOR-based string decryption** and a **domain generation algorithm (DGA)** to supplement or replace static command-and-control infrastructure by generating multiple `.xyz` domains for beaconing. Decrypted strings and observed behavior indicated capabilities beyond credential theft, including **SOCKS proxying, backconnect access, firewall rule manipulation, shellcode execution, and tasking endpoints**, underscoring that MetaStealer functioned as a flexible post-compromise stealer and access tool rather than a simple infostealer.
Aug 15, 2026