A critical zero-day vulnerability (CVE-2025-8088) in WinRAR’s Windows version (pre-7.13) enabled path traversal attacks, allowing threat actors to deploy malware via malicious RAR archives. Exploited by RomCom (Storm-0978) and Paper Werewolf (GOFFEE), the flaw facilitated phishing campaigns targeting financial, manufacturing, defense, and logistics sectors in Europe, Canada, and Russia. Attackers disguised malicious archives as job resumes or official communications, deploying backdoors (SnipBot, RustyClaw, Mythic) for persistence and data exfiltration. The exploit leveraged alternate data streams (ADS) to hide payloads in Windows Startup folders, achieving remote code execution upon user login. While no mass exploitation was reported by August 2025, the vulnerability’s public disclosure (CVSS 8.8) and dark web sale ($80,000) heightened risks of copycat attacks. Organizations faced potential data breaches, system compromises, and operational disruptions, though no confirmed large-scale data leaks or ransomware incidents were tied to this flaw. Patching (WinRAR 7.13) mitigated the risk, but delayed updates left users exposed to targeted cyber espionage and financial theft.