Loading malware…
TamperedChef, also referred to as EvilAI in broader campaign tracking and sometimes associated with BaoLoader in overlapping reporting, is a Windows-focused infostealer campaign and malware family distributed through trojanized productivity software. It commonly masquerades as legitimate utilities such as PDF editors, manual readers, calendar applications, ZIP tools, and similar desktop software, often delivered through malvertising, sponsored search results, and poisoned download sites. Operators have repeatedly used valid code-signing certificates obtained through shell companies or other abuse of trust mechanisms to make installers appear legitimate and reduce user suspicion.
The malware typically arrives through user-initiated installation of a fake but functional application. After execution, it establishes persistence, commonly via scheduled tasks and in some cases registry-based autoruns, then launches an obfuscated JavaScript payload through Node.js. TamperedChef is notable for delayed activation: malicious behavior may remain dormant for weeks or even months after installation, likely to evade sandboxing, incident response correlation, and ad-platform scrutiny. The staged architecture allows the malware to beacon to command-and-control infrastructure, receive instructions or updated payloads, and selectively activate follow-on functionality.
Observed TamperedChef behavior includes host reconnaissance, enumeration of installed security products, checking for active browser processes, and theft of browser-stored data. It has targeted credentials, cookies, autofill data, DPAPI-protected secrets, and locally accessible password-manager data. To facilitate collection, it may terminate browser processes and copy browser data stores before extraction. Exfiltration of harvested information to attacker-controlled infrastructure is a core function. Reporting also links the broader TamperedChef ecosystem to delivery of additional second-stage payloads including adware, browser hijackers, remote access tools, and proxy-style malware, though these behaviors vary by cluster and campaign.
Campaigns associated with TamperedChef have been active since at least 2023 and have been tracked in multiple overlapping clusters, including activity linked to CL-CRI-1089, CL-UNK-1090, and CL-UNK-1110. Victimization has been global rather than tightly sector-specific, although infections have been observed across enterprise environments and in industries where users frequently search for manuals or productivity tools. The operation stands out for its scale, polished lure infrastructure, repeated abuse of code-signing, and industrialized use of advertising and fake software branding to support credential theft and broader post-compromise monetization.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Operations attributed to CL-CRI-1089 also include Recipe Lister and Calendaromatic, both of which fall under a broader designation known as TamperedChef (aka EvilAI), an ongoing series of campaigns that involve using trojanized versions of productivity software to deliver potentially unwanted programs (PUPs) and adware.
33 distinct techniques documented for this family, organized by ATT&CK tactic.
These campaigns typically employ malicious ads that direct users to sites hosting the applications.
TamperedChef creates a scheduled task to remain active across reboots... /TN “sys_component_health_{UID}” ... /SC DAILY /ST 10:51 /RI 240 /DU 24:00 /F
Once executed, it silently triggers Node.js (node.exe) via the Windows command line. Node.js executes a JavaScript payload dropped in the user’s temporary folder.
The explicit command line executed is: powershell.exe -NoProfile -WindowStyle Minimized -Command \ "Start-Process 'C:\Users\user\AppData\Local\PDFInstaller\node.exe' \ -ArgumentList '.' \ -WorkingDirectory 'C:\Users\user\AppData\Local\PDFInstaller\' \ -WindowStyle Hidden"
TamperedChef creates a scheduled task to remain active across reboots... /TN “sys_component_health_{UID}” ... /SC DAILY /ST 10:51 /RI 240 /DU 24:00 /F
Most of the campaigns we observed used some form of obfuscation or defense evasion techniques for their loader or stealer components.
TamperedChef is delivered via user-initiated downloads. It comes bundled with seemingly legitimate software like PDF editors or manual readers.
MITRE ATT&CK Mapping ... Defense Evasion: T1218 — Signed Binary Proxy Execution
To hinder forensic analysis and automated sandboxing, helper.js incorporates several defensive mechanisms before initiating any malicious network activity.
MITRE ATT&CK Mapping Execution: T1059 — Command & Scripting Interpreter Credential Access: T1555 — Credentials from Password Stores, T1003 — OS Credential Dumping
It queries the registry to enumerate installed security and antivirus software, often searching for uninstall strings or configuration keys.
It then spawns a command shell to fingerprint the host by executing reg.exe QUERY "HKLM\Software\Microsoft\Cryptography" /v MachineGuid
The malware uses Windows Management Instrumentation (WMI) to check if browsers like Chrome or Edge are running: ... Get-WmiObject Win32_Process | Where-Object { $_.Name -eq ‘chrome.exe’ }
TamperedChef actively surveys the system to identify browsers and security software.
To hinder forensic analysis and automated sandboxing, helper.js incorporates several defensive mechanisms before initiating any malicious network activity.
Its primary objective is clipboard hijacking. The Node.js engine spawns subsequent cmd.exe processes to interact with a bundled tool named clipboard.exe . Telemetry captures the execution of clipboard.exe -paste to read stored clipboard data, followed by clipboard.exe -copy to manipulate or inject new content.
To evade network-level detection, all traffic utilizes a symmetric XOR cipher.
This includes continuous command and control (C2) methods enabling adversaries to retrieve additional payloads, such as information stealers, proxy tooling or remote access Trojans (RATs).
Communications are handled by Module 159, which implements a custom bi-directional encrypted protocol over HTTPS.
32 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
21 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned only in passing as another malware/tool associated with code-signing certificate abuse.
A named Windows attack campaign umbrella linked by researchers to the same broader activity cluster associated with FlutterShell.
A broader campaign/malware designation covering operations such as Recipe Lister and Calendaromatic. It involves trojanized productivity applications used to deliver PUPs and adware to macOS users.
Malware distributed via trojanized productivity applications such as PDF editors, calendar apps, ZIP tools, and GIF makers. It uses signed apps and legitimate-looking download sites, often delays second-stage execution for weeks, and delivers payloads including adware/browser hijackers, information stealers, remote access trojans, and in some cases proxy-style malware.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.