UAC-0226 GIFTEDCROOK PowerShell NT API Reflective PE Loader via ProgramData

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•9

Detects obfuscated PowerShell scripts that utilize the Microsoft.Win32.UnsafeNativeMethods namespace to resolve native NT API functions (NtAllocateVirtualMemory, NtWriteVirtualMemory, etc.) and perform reflective code loading of a headerless PE payload from a staging directory (C:\ProgramData\wt1). This activity is associated with UAC-0226/GIFTEDCROOK threat campaigns.