Cyber Espionage Alert: GIFTEDCROOK Malware Targets Ukraine via Excel Bombshells

Summary

• Introduction: A spying campaign using GIFTEDCROOK malware is hitting Ukrainian government and military targets
• Who is behind it: Ukraine’s CERT-UA tracks the activity as UAC-0226
• Malware Description: GIFTEDCROOK steals browser passwords, cookies and history
• Detection and Response: How defenders are spotting the macro-laden Excel files
• Implications: Why the macro trick still works and what organizations can do

Excel files carry a new stealer

Ukraine’s computer emergency response team, CERT-UA, warned in April 2025 of an espionage campaign aimed at Ukrainian military units, law enforcement agencies and local governments, especially near the eastern border. The lure is an Excel spreadsheet. Inside is a stealer called GIFTEDCROOK.

Who CERT-UA says is behind it

CERT-UA tracks the activity as UAC-0226. The phishing emails pose as messages about topics their targets care about, such as demining, fines, drone production and property compensation. The agency has not publicly tied the cluster to a specific government, though the targets suggest an intelligence motive.

How GIFTEDCROOK steals data

The emails carry macro-enabled .xlsm files. If the victim enables macros, the document runs code that installs a PowerShell reverse shell and GIFTEDCROOK. The stealer collects saved credentials, cookies and browsing history from Chrome, Edge and Firefox and sends them to the attackers. It also works to evade detection.

Why macros still work

Macros are an old trick. They keep working because people trust spreadsheets that appear to come from a known agency or contractor, and one click on “Enable Content” is enough.

How defenders are responding

Security vendors have published detection rules for the campaign, and CERT-UA released indicators of compromise. Behavioral detection helps here: an Excel process that spawns PowerShell is a strong signal on its own.

Basic controls

Blocking macros in files from the internet, which Microsoft now does by default in Office, closes the main door. Training staff to distrust unexpected attachments helps too.

Who else should pay attention

The campaign targets Ukraine. The techniques are generic, though, and any organization whose staff handle Excel attachments from outside partners faces the same risk.

Steps to take now

Check that macro blocking for internet-sourced files is enforced through Group Policy. Alert on Office applications launching PowerShell. Review browser credential storage, since stolen saved passwords are what GIFTEDCROOK is after.

Those three controls would blunt this campaign.

Dan Evert, CCNP

Dan Evert is a self proclaimed Router Jockey. Dan got heavily involved in networking right out of high school and has never looked back! Dan is giving back by working with high school students to get them involved and interested in Networking and Security.