TamperedChef Malware Abuses Signed Apps to Deliver Stealers and RATs

Key Takeaways

• A new malware campaign, dubbed TamperedChef (also known as EvilAI), is actively distributing information stealers and Remote Access Trojans (RATs) by embedding them within seemingly legitimate, signed productivity applications.
• The threat actors behind TamperedChef have leveraged sophisticated tactics, including the establishment of shell companies to acquire legitimate code-signing certificates, making their malicious applications appear trustworthy to victims and standard security tools.
• Since early 2023, hundreds of these campaigns have been observed globally, with researchers identifying over 4,000 unique samples and more than 100 variants, affecting over 50% of monitored enterprise environments.
• Infections can remain dormant for weeks or months before deploying their full payload, which includes exfiltrating credentials, establishing remote control, and in some cases, turning victim machines into proxy nodes.

Sophisticated TamperedChef Malware Evades Detection with Signed Productivity Apps

A widespread and persistent malware operation, identified as TamperedChef, or alternatively EvilAI, has been observed leveraging a highly deceptive strategy: packaging potent information stealers and Remote Access Trojans (RATs) within digitally signed productivity applications. This sophisticated campaign aims to surreptitiously compromise systems, enabling attackers to harvest sensitive user credentials and maintain persistent control over infected machines. For a comprehensive breakdown of this threat, readers can refer to the Unit42 report.

Since the beginning of 2023, threat actors have deployed malware hidden within common utility applications, such as PDF editors, calendar tools, ZIP extractors, and GIF creators. Crucially, these applications function exactly as advertised, which significantly lowers victim suspicion and allows the malicious components to go undetected. The malware can lie dormant on a device for extended periods, sometimes weeks or even months, before initiating its payload, thereby bypassing many conventional security measures.

Extensive Global Impact and Organized Operations

Analysts at Unit42 have meticulously tracked three distinct clusters of this activity, designated CL-CRI-1089, CL-UNK-1090, and CL-UNK-1110. According to their findings, shared with Cyber Security News (CSN), researchers discovered more than 4,000 unique samples and over 100 different variants associated with these campaigns. The global reach of TamperedChef is significant, with infections detected in over half of the enterprise environments monitored worldwide.

A key factor contributing to TamperedChef’s danger is its meticulous imitation of legitimate software. The distribution infrastructure includes professionally designed download pages featuring legal disclaimers, contact information, and straightforward download buttons, all hosted on domains that appear entirely authentic. The sheer scale of this operation indicates a well-resourced and highly organized threat group. Researchers estimate that the operators of just one cluster invested upwards of $10,000 in acquiring code-signing certificates alone. This substantial financial commitment suggests a long-term, profit-motivated campaign, far exceeding the typical scope of less sophisticated adware operations.

Abuse of Code-Signing Certificates for Trust Evasion

One of the most insidious tactics employed by TamperedChef is the use of legitimate code-signing certificates to imbue their malicious payloads with an aura of trustworthiness. These certificates, typically issued to verified companies, lead most security solutions to treat the signed software as benign. To exploit this, the threat actors established a network of shell companies across various countries, including Ukraine, Malaysia, Israel, the UK, and the US, to obtain valid certificates.

The CL-CRI-1089 cluster, for instance, was linked to 34 unique code-signing entities, identified through shared certificate usage, overlapping code, and corporate structure analysis. In one example, the Calendaromatic campaign distributed a self-extracting archive containing a fully functional calendar application alongside a covert remote access Trojan. Once activated, this RAT communicated with a command-and-control server to fetch a second-stage payload, further compromising the victim’s system.

The CL-UNK-1090 cluster demonstrated an even more integrated approach, with the same group reportedly owning both the advertising agencies and the companies responsible for signing the malware. Over 20,000 unique advertisements related to this cluster were tracked via ad transparency platforms, promoting campaigns such as CrystalPDF, OneZip, and Easy2Convert. The operators also leveraged generative AI to rapidly create numerous distribution websites, each appearing similar but possessing distinct underlying code.

Payloads: Stealers, RATs, and Post-Infection Behavior

Upon activation, a TamperedChef application delivers one of two primary payload categories, depending on the specific campaign. The first category includes adware and browser hijackers, designed to redirect search queries and seize control of browsing activities.

The second, and more severe, category involves the deployment of information stealers and remote access Trojans. These tools are engineered to target saved credentials and grant attackers the ability to execute commands remotely on the compromised system. Second-stage payloads are frequently delivered weeks after the initial installation, via an upstream API connection, long after any initial suspicion has subsided.

In certain campaigns, such as AppSuite, researchers also identified proxy-style malware that reroutes traffic through infected machines. The CL-CRI-1089 cluster exhibited the most aggressive credential theft capabilities, while the CL-UNK-1090 cluster favored more stealthy, in-memory payloads, leaving fewer forensic traces on disk.

What You Should Do

• Enhance Endpoint Security: Ensure all endpoint detection and response (EDR) solutions are fully updated across all devices to detect and block TamperedChef variants.
• Implement Enterprise Browsers: Utilize enterprise-grade browsers that incorporate robust malicious download blocking features before files reach end-users.
• Strengthen User Awareness Training: Educate employees on the risks associated with downloading unfamiliar software, emphasizing that even professionally designed download sites can host malicious content.
• Prompt Incident Response: In the event of a suspected infection, immediately quarantine affected files, eliminate any persistence mechanisms (e.g., scheduled tasks), reset credentials for all potentially compromised accounts, and thoroughly review access logs for signs of credential misuse.
• Monitor for IoCs: Integrate the provided Indicators of Compromise (IoCs) into your security information and event management (SIEM) systems and threat intelligence platforms for proactive detection.

Indicators of Compromise (IoCs)

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.