Loading malware…
TamperedChef, also known as EvilAI in broader campaign reporting, is a Windows-focused malware family and campaign set centered on trojanized productivity and utility applications masquerading as legitimate software such as PDF editors, manual readers, calendar tools, ZIP utilities, and similar desktop apps. It has been active since at least 2023 and is commonly distributed through malvertising, sponsored search results, and poisoned download sites that present polished, legitimate-looking software portals. Operators have repeatedly used valid code-signing certificates, shell companies, and delayed activation to reduce user suspicion and evade security controls.
A well-documented TamperedChef infostealer variant installs through user-initiated downloads of fake software installers, then launches a JavaScript payload via Node.js, commonly through command-shell execution. It establishes persistence with scheduled tasks using benign-looking names, performs host and security-product reconnaissance, checks for running browsers, and targets browser-stored credentials, cookies, autofill data, DPAPI-protected secrets, and locally accessible password-manager data. To facilitate theft, it may terminate browser processes and copy browser profile databases before exfiltrating collected data to remote command-and-control infrastructure. Some samples also support follow-on payload delivery or remote instruction updates.
Across the broader TamperedChef ecosystem, researchers have identified multiple related clusters delivering different second-stage outcomes, including information stealers, remote access trojans, browser hijackers, adware, backdoors, and occasionally proxy-style tooling. The malware often preserves expected application functionality while delaying malicious behavior for weeks or months, aligning execution with advertising lifecycles and complicating detection and attribution. Campaigns have shown global victimization rather than narrow sector targeting, though organizations whose users frequently search for manuals, converters, or productivity tools have been repeatedly exposed. Abuse of code-signing certificates and large-scale advertising infrastructure indicates a mature, well-resourced operation.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Operations attributed to CL-CRI-1089 also include Recipe Lister and Calendaromatic, both of which fall under a broader designation known as TamperedChef (aka EvilAI), an ongoing series of campaigns that involve using trojanized versions of productivity software to deliver potentially unwanted programs (PUPs) and adware.
33 distinct techniques documented for this family, organized by ATT&CK tactic.
These campaigns typically employ malicious ads that direct users to sites hosting the applications.
TamperedChef creates a scheduled task to remain active across reboots... /TN “sys_component_health_{UID}” ... /SC DAILY /ST 10:51 /RI 240 /DU 24:00 /F
Once executed, it silently triggers Node.js (node.exe) via the Windows command line. Node.js executes a JavaScript payload dropped in the user’s temporary folder.
The explicit command line executed is: powershell.exe -NoProfile -WindowStyle Minimized -Command \ "Start-Process 'C:\Users\user\AppData\Local\PDFInstaller\node.exe' \ -ArgumentList '.' \ -WorkingDirectory 'C:\Users\user\AppData\Local\PDFInstaller\' \ -WindowStyle Hidden"
TamperedChef creates a scheduled task to remain active across reboots... /TN “sys_component_health_{UID}” ... /SC DAILY /ST 10:51 /RI 240 /DU 24:00 /F
Most of the campaigns we observed used some form of obfuscation or defense evasion techniques for their loader or stealer components.
TamperedChef is delivered via user-initiated downloads. It comes bundled with seemingly legitimate software like PDF editors or manual readers.
MITRE ATT&CK Mapping ... Defense Evasion: T1218 — Signed Binary Proxy Execution
To hinder forensic analysis and automated sandboxing, helper.js incorporates several defensive mechanisms before initiating any malicious network activity.
MITRE ATT&CK Mapping Execution: T1059 — Command & Scripting Interpreter Credential Access: T1555 — Credentials from Password Stores, T1003 — OS Credential Dumping
It queries the registry to enumerate installed security and antivirus software, often searching for uninstall strings or configuration keys.
It then spawns a command shell to fingerprint the host by executing reg.exe QUERY "HKLM\Software\Microsoft\Cryptography" /v MachineGuid
The malware uses Windows Management Instrumentation (WMI) to check if browsers like Chrome or Edge are running: ... Get-WmiObject Win32_Process | Where-Object { $_.Name -eq ‘chrome.exe’ }
TamperedChef actively surveys the system to identify browsers and security software.
To hinder forensic analysis and automated sandboxing, helper.js incorporates several defensive mechanisms before initiating any malicious network activity.
Its primary objective is clipboard hijacking. The Node.js engine spawns subsequent cmd.exe processes to interact with a bundled tool named clipboard.exe . Telemetry captures the execution of clipboard.exe -paste to read stored clipboard data, followed by clipboard.exe -copy to manipulate or inject new content.
To evade network-level detection, all traffic utilizes a symmetric XOR cipher.
This includes continuous command and control (C2) methods enabling adversaries to retrieve additional payloads, such as information stealers, proxy tooling or remote access Trojans (RATs).
Communications are handled by Module 159, which implements a custom bi-directional encrypted protocol over HTTPS.
34 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
23 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A trojanized application referenced for comparison. It used a covert C2 channel and served as a point of comparison for SilentMare, but the report states SilentMare and BaoLoader should not be conflated with it.
Mentioned only in passing as another malware/tool associated with code-signing certificate abuse.
A named Windows attack campaign umbrella linked by researchers to the same broader activity cluster associated with FlutterShell.
A broader campaign/malware designation covering operations such as Recipe Lister and Calendaromatic. It involves trojanized productivity applications used to deliver PUPs and adware to macOS users.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.