Google Warns of Persistent WinRAR Vulnerability Exploitation

Security researchers at Google have warned that state-sponsored hackers and cybercriminals continue to exploit a critical vulnerability in the popular WinRAR file archiving software, more than six months after a patch became available. The flaw, known as CVE-2025-8088, affects older versions of the Windows program and has been used to deliver malware to targets worldwide, including government and military entities in Ukraine.

The vulnerability enables attackers to create malicious RAR archive files that appear harmless but secretly inject harmful code onto a victim's computer. When users open the archive, a decoy file such as a PDF distracts them while the payload, often hidden in alternate data streams, is placed in a system location like the Windows Startup folder. This allows the malware to execute automatically upon the next login, providing hackers with persistent access without user interaction. ESET, a cybersecurity firm, first identified the issue in July 2025 after detecting its use in phishing emails by the Russian-linked RomCom hacking group, which deployed backdoor malware.

Google's Threat Intelligence Group detailed the ongoing attacks in a report released Tuesday,...