GIFTEDCROOK Malware Evolves To Steal Sensitive Data

The cyber group upgraded their spyware to steal data from Ukrainian, through fake military emails and Telegram messages.

The hacking group UAC-0226 upgraded their GIFTEDCROOK spyware to evolve from basic web browser data theft into advanced software, capable of extracting sensisite computer files.

According to researchers at Arctic Wolf Labs, the group launched these upgraded attacks just as Ukraine and Russia were holding talks in Istanbul in June 2025.

‘‘This operation most likely focused on intelligence gathering through data exfiltration from compromised devices,” Arctic Wolf Labs reported, noting that the campaign ramped up just before the June 2 Istanbul negotiations on prisoner and body exchanges.

The hackers used fake emails made to look like military messages to trick people into opening infected files. These emails often claimed to include information about conscription or administrative fines. If a victim clicked the link or opened the file and followed the instructions, the spyware would secretly install itself and begin stealing files.

The updated versions of the malware allowed users to search for particular file types and recent documents, as well as browser cookies and passwords from Chrome, Edge, and Firefox. Arctic Wolf Labs explains that the hackers transmitted all stolen data through Telegram channels.

One fake document pretended to be a list of people being drafted into the military. It asked readers to enable macros, a common trick used by hackers to launch malware. Researchers also found that the email system used by UAC-0226 is shared with other hacker groups targeting Ukraine, suggesting a wider campaign.

The experts predict that the malware will continue to evolve through time. Organizations need to teach their employees about phishing email identification and secure tool usage, and stay alert as cyberattacks become more advanced and more closely linked to real-world events.