TamperedChef Campaigns via Malicious Productivity Apps

Since early 2024, researchers have tracked a significant rise in TamperedChef-style activity (also known as EvilAI), which involves the distribution of trojanized productivity tools like PDF editors, calendars, and file converters. These campaigns utilize sophisticated social engineering, featuring high-quality websites and valid code-signing certificates to masquerade as legitimate software. Multiple distinct clusters, including CL-CRI-1089 and CL-UNK-1090, have been identified, with over 4,000 samples and 100 variants observed globally.

Technically, the malware exhibits a unique delivery model: it remains dormant for weeks to evade detection before activating a secondary payload, such as an information stealer or remote access Trojan (RAT). The actors demonstrate a deep vertical integration of malware development and advertising, particularly in the CL-UNK-1090 cluster, where operators manage the ad agencies and corporate shell entities used to sign the malicious code.

The widespread prevalence of these threats—detected in over 50% of some customer environments—poses a major organizational risk. By leveraging malvertising and AI-generated content, the attackers have scaled their operations to target global users across all sectors, primarily aiming to exfiltrate credentials and establish persistent access for further exploitation.