WinRAR ADS Path Traversal Lets UAC-0226 Deploy GIFTEDCROOK Against Ukrainian Targets

Threat actors constantly refine their methods to stay ahead of defenders. Recently, the UAC-0226 threat group updated its tactics to deploy the GIFTEDCROOK information stealer against Ukrainian targets. Rather than tricking users into manually clicking a malicious script, the attackers now exploit a WinRAR vulnerability that allows path traversal via Alternate Data Streams (ADSs). This flaw allows them to plant malicious payloads silently when a victim simply extracts an…