A newly identified malware campaign leveraging a Ukrainian email service to build credibility has been uncovered by cybersecurity researchers. The operation begins with an email sent from an address hosted on ukr[.]net, a popular Ukrainian provider previously abused by the Russian-linked threat actor APT28 in past campaigns. According to an advisory by researchers at ClearSky, who have named the malware "BadPaw," the attack is triggered when a recipient clicks a link claiming to host a ZIP archive. Instead of initiating a direct download, the victim is redirected to a domain that loads a tracking pixel, allowing the attacker to confirm engagement. A second redirect then delivers the ZIP file. Although the archive appears to contain a standard HTML file, ClearSky researchers found it is…