Loading story…
Researchers linked multiple fake PDF and document-converter utilities to a broader malware delivery ecosystem that abuses trusted software components, valid code-signing certificates, and Electron or Nativefier-based installers to evade detection. Analyses of TamperedChef, Aura Document Studio, Omni Transform, Doc Convert Wizard, OpenMyManual, and ManualReaderPro describe staged installation chains in which browser-downloaded executables launch temporary installers, deploy rebranded applications, and contact shared infrastructure including softwareinstallercdn[.]com, tool[.]securedocumentinstaller[.]com, and docu-flex[.]com. Several samples reused identical payloads across different publisher names, while others were signed with valid EV certificates, reinforcing the appearance of legitimacy.
The reported payloads include clipboard hijacking, host fingerprinting, persistence, and a JavaScript backdoor embedded in helper.js that retrieves the Windows MachineGuid, communicates over encrypted HTTPS with hardcoded command-and-control domains, and executes server-supplied code via eval(). The installers also showed signs of stealth and anti-analysis, including long dormancy periods, WebView2Loader abuse, Chromium-style child processes, plausible DLL names used as camouflage, and suspected DLL sideloading involving files such as libEGL.dat and d3dcompiler_47.dll. The campaign echoes older trust-based intrusion techniques documented in malware that hid behind signed Avast and Oracle executables through DLL search-order hijacking, underscoring how attackers continue to weaponize legitimate binaries and software trust to deliver credential theft and follow-on malware.
Pull IOCs and campaign context straight into your stack.
6 events from the most recent confirmed update back to the earliest known activity.
A report analyzed a coordinated ecosystem of fake PDF and document-converter installers, linking samples through shared tooling, payload reuse, code-signing patterns, and infrastructure such as softwareinstallercdn[.]com.
A report analyzed the FlipFormat_947850.exe and Doc Convert Wizard installer chain, describing silent downloads from tool[.]securedocumentinstaller[.]com, NSIS extraction, and a likely DLL sideloading or proxying setup tied to an Electron-based payload.
A report described the TamperedChef malvertising-driven malware campaign, detailing fake utilities, abuse of signed software and developer tools, and two payload chains involving clipboard hijacking and a JavaScript backdoor.
A report described PDF SparkOnSoft and OneBrowser as a coordinated fake-utility malware ecosystem using Inno Setup installers, rotating filenames, scheduled-task persistence, and deceptive uninstall behavior. It also highlighted alleged abuse of the Windows Trusted Root Certification Authorities store, self-deleting updater components, and infrastructure including oneinternetbrowser[.]com/service/update2 and crowdsourcesoftware[.]com.
A report documented Metamorfo banking malware hiding by abusing an Avast executable, describing the technique used to evade detection through a trusted binary.
A report analyzed a malicious MSVCR100.dll that abused DLL search order hijacking through Oracle's signed unpack200.exe binary, decrypted an embedded payload, and launched a modified Mimikatz for credential theft.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 74 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
6 references tracked. Mallory keeps watching after this page renders.
medium.com
Open sourcemedium.com
Open sourcemedium.com
Open sourcemedium.com
Open sourcemedium.com
Open sourcemedium.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that the **TamperedChef** malware operation, also tracked as **EvilAI**, has distributed trojanized productivity software through malvertising and polished download sites, posing as tools including **Calendaromatic**, **DocuFlex**, **AppSuite PDF**, **OneZip**, **CrystalPDF**, **PDF-Ezy**, and **RapiDoc**. The campaign has been active since early 2023 and uses valid code-signing certificates, delayed second-stage delivery, persistence mechanisms, and stealthy execution to evade detection while deploying adware, browser hijackers, information stealers, RATs, and proxy-style payloads. Unit 42 said it identified more than **4,000 unique samples** and **100+ variants**, with infections observed in more than half of monitored enterprise environments. Analysis of the **rapidoc** subcluster linked the activity to broader fake-app campaigns and highlighted code reuse, certificate rotation, and infrastructure overlap with related **BaoLoader** activity. Researchers described two main branches: a **Calendaromatic** `7zSFX` dropper line tied to shell companies including **CROWN SKY LLC** and **MARKET FUSION INNOVATIONS LLC**, and a **Neutralinojs**-based **RapiDoc** stage-0 line tied to **CANDY TECH LTD**. A recurring tracking artifact was the **GlobalSign GCC R45 EV CodeSigning CA 2020** sub-CA certificate with serial `77BD0E05B7590BB61D4761531E3F75ED`, which was used to connect shell-company activity across Israel, Ukraine, Panama, Malaysia, Estonia, and the United States; researchers also found an unsigned sibling sample communicating with `calendaromatic.com`, suggesting some operators may be dropping code signing to reduce attribution risk.
Jun 29, 2026
Security researchers reported multiple malware campaigns using trojanized utility software—including fake PDF converters, ZIP tools, and a malicious PDF editor—to infect users who arrive via search ads and download portals. Intezer identified two families, **SilentMare** and **HollowMare**, embedded in seemingly legitimate utilities: SilentMare acts as a downloader and foothold, using custom installers, scheduled-task persistence, daily updater check-ins, and AES-encrypted .NET payloads executed in memory, while HollowMare behaves more like a potentially unwanted application that installs browser extensions or hijacks default search settings. Truesec separately described a malicious **Appsuite PDF Editor** delivering **TamperedChef**, reinforcing the use of fake productivity tools as an infection vector. The reporting shows a broader resurgence of Trojan horse delivery through software impersonation, including lures tied to AI-themed branding and homoglyph abuse to make malicious sites and applications appear legitimate. Intezer said SilentMare and HollowMare shared some infrastructure and code-signing certificate procurement patterns, including certificates issued to Israeli entities, but found the evidence insufficient to attribute both families to the same actor. Researchers advised blocking these utilities in enterprise environments because even apparently functional apps may upload user files to untrusted servers, establish persistence, or alter browser behavior without a second-stage payload.
Aug 14, 2026
Threat actors are increasingly leveraging fake websites and bogus software installers to distribute malware, employing advanced techniques such as AI-generated web pages and code-signed malicious applications. One campaign involves the use of the legitimate Syncro remote access tool, where attackers create their own signed builds and distribute them via mass-generated, AI-powered fake websites that closely mimic official application sites. These malicious sites are promoted through search engine optimization and phishing emails, often masquerading as trusted brands like antivirus or password management tools, to trick users into downloading malware-laden installers. Another ongoing global campaign, dubbed TamperedChef, uses counterfeit installers for popular software to deliver JavaScript-based remote access malware. The attackers utilize malvertising, SEO, and abused digital certificates from shell companies to increase the credibility of their malicious payloads. The infrastructure supporting these campaigns is described as industrialized, with operators regularly acquiring new code-signing certificates to evade detection. Both campaigns highlight the growing sophistication and scale of malvertising operations targeting users through deceptive download sites and installer packages.
Jun 29, 2026