A reported GIFTEDCROOK campaign shows how a seemingly ordinary archive can be turned into a delivery path for browser, vault, VPN, and document theft.