Loading story…
Researchers reported that the TamperedChef malware operation, also tracked as EvilAI, has distributed trojanized productivity software through malvertising and polished download sites, posing as tools including Calendaromatic, DocuFlex, AppSuite PDF, OneZip, CrystalPDF, PDF-Ezy, and RapiDoc. The campaign has been active since early 2023 and uses valid code-signing certificates, delayed second-stage delivery, persistence mechanisms, and stealthy execution to evade detection while deploying adware, browser hijackers, information stealers, RATs, and proxy-style payloads. Unit 42 said it identified more than 4,000 unique samples and 100+ variants, with infections observed in more than half of monitored enterprise environments.
Analysis of the rapidoc subcluster linked the activity to broader fake-app campaigns and highlighted code reuse, certificate rotation, and infrastructure overlap with related BaoLoader activity. Researchers described two main branches: a Calendaromatic 7zSFX dropper line tied to shell companies including CROWN SKY LLC and MARKET FUSION INNOVATIONS LLC, and a Neutralinojs-based RapiDoc stage-0 line tied to CANDY TECH LTD. A recurring tracking artifact was the GlobalSign GCC R45 EV CodeSigning CA 2020 sub-CA certificate with serial 77BD0E05B7590BB61D4761531E3F75ED, which was used to connect shell-company activity across Israel, Ukraine, Panama, Malaysia, Estonia, and the United States; researchers also found an unsigned sibling sample communicating with calendaromatic.com, suggesting some operators may be dropping code signing to reduce attribution risk.
Get the infrastructure and lures behind it.
5 events from the most recent confirmed update back to the earliest known activity.
Unit 42 disclosed that TamperedChef comprised more than 4,000 unique samples and over 100 variants, with detections in more than half of monitored enterprise environments worldwide. The researchers also described three activity clusters and said the malware delivered payloads including stealers, RATs, adware, browser hijackers, and proxy-style tools.
Analysis uncovered a novel unsigned sibling sample communicating with calendaromatic.com, suggesting some operators may be moving away from code signing to make tracking harder. The finding added to evidence of infrastructure and code reuse across related TamperedChef and BaoLoader activity.
Researchers identified a separate 'rapidoc' subcluster built around a Neutralinojs-based RapiDoc stage-0 loader and linked it to CANDY TECH LTD. The branch was associated with signed binaries, persistence, delayed activation, and second-stage payload delivery.
One identified TamperedChef branch used Calendaromatic-themed 7zSFX droppers and was tied to code-signing activity associated with shell companies including CROWN SKY LLC and MARKET FUSION INNOVATIONS LLC. This branch helped establish certificate and code-reuse links across the broader malware cluster.
Researchers said the TamperedChef/EvilAI operation has been active since early 2023, distributing malware disguised as productivity software such as PDF editors, calendar apps, ZIP tools, and similar utilities. The campaign used professional download sites and delayed second-stage delivery to reduce suspicion and evade detection.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 20 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
6 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcecybersecuritynews.com
Open sourceorigin-unit42.paloaltonetworks.com
Open sourcegist.github.com
Open sourcelabs.withsecure.com
Open sourcegbhackers.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers linked multiple fake PDF and document-converter utilities to a broader malware delivery ecosystem that abuses trusted software components, valid code-signing certificates, and Electron or Nativefier-based installers to evade detection. Analyses of **TamperedChef**, **Aura Document Studio**, **Omni Transform**, **Doc Convert Wizard**, **OpenMyManual**, and **ManualReaderPro** describe staged installation chains in which browser-downloaded executables launch temporary installers, deploy rebranded applications, and contact shared infrastructure including `softwareinstallercdn[.]com`, `tool[.]securedocumentinstaller[.]com`, and `docu-flex[.]com`. Several samples reused identical payloads across different publisher names, while others were signed with valid EV certificates, reinforcing the appearance of legitimacy. The reported payloads include clipboard hijacking, host fingerprinting, persistence, and a JavaScript backdoor embedded in `helper.js` that retrieves the Windows `MachineGuid`, communicates over encrypted HTTPS with hardcoded command-and-control domains, and executes server-supplied code via `eval()`. The installers also showed signs of stealth and anti-analysis, including long dormancy periods, WebView2Loader abuse, Chromium-style child processes, plausible DLL names used as camouflage, and suspected DLL sideloading involving files such as `libEGL.dat` and `d3dcompiler_47.dll`. The campaign echoes older trust-based intrusion techniques documented in malware that hid behind signed Avast and Oracle executables through DLL search-order hijacking, underscoring how attackers continue to weaponize legitimate binaries and software trust to deliver credential theft and follow-on malware.
Jun 29, 2026
Threat actors used **Google Ads malvertising** and look-alike websites to distribute a trojanized Windows application branded as *AppSuite PDF Editor*, delivering an information-stealing payload tracked as **TamperedChef**. Sophos X-Ops/MDR investigations reported the operation was first detected in September 2025, with infrastructure activity traced back to late June 2025, when attackers registered multiple spoofed sites to impersonate legitimate PDF-editing and “manual finder” tooling. The campaign exploited common search behavior—particularly users looking for PDF editors and appliance/product manuals—to drive victims to malicious installers that appeared legitimate but silently deployed an infostealer targeting browser-stored data and other sensitive information.
Jun 29, 2026
Threat actors are increasingly leveraging fake websites and bogus software installers to distribute malware, employing advanced techniques such as AI-generated web pages and code-signed malicious applications. One campaign involves the use of the legitimate Syncro remote access tool, where attackers create their own signed builds and distribute them via mass-generated, AI-powered fake websites that closely mimic official application sites. These malicious sites are promoted through search engine optimization and phishing emails, often masquerading as trusted brands like antivirus or password management tools, to trick users into downloading malware-laden installers. Another ongoing global campaign, dubbed TamperedChef, uses counterfeit installers for popular software to deliver JavaScript-based remote access malware. The attackers utilize malvertising, SEO, and abused digital certificates from shell companies to increase the credibility of their malicious payloads. The infrastructure supporting these campaigns is described as industrialized, with operators regularly acquiring new code-signing certificates to evade detection. Both campaigns highlight the growing sophistication and scale of malvertising operations targeting users through deceptive download sites and installer packages.
Jun 29, 2026