GIFTEDCROOK Stealer Accessing KeePass Databases and VPN Config Files

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•0

Detects unauthorized access to KeePass database (.kdbx) and VPN configuration (.ovpn) files by processes originating from the C:\ProgramData\ directory. This behavior aligns with the activity of the GIFTEDCROOK information stealer observed during UAC-0226 campaigns, where malicious payloads are executed from staging folders within ProgramData.