## Overview

TamperedChef (also tracked as EvilAI, ManualFinder, OneStart) is a long-running, financially-motivated malware-distribution operation that has been active since at least mid-2023. Palo Alto Unit 42's May 2026 report consolidated the public ecosystem into three Unit 42 activity clusters — CL-CRI-1089, CL-UNK-1090, CL-UNK-1110 — based on overlaps in code-signing certificates, Electron application boilerplate, install-time scheduled tasks, and a shared post-install command-and-control choreography. The cluster naming is operational; multiple vendors (Truesec, G DATA, Field Effect, Expel) have published overlapping subsets of the same activity under different brand names.

## Distribution and Social Engineering

The operators run thousands of professionally designed lookalike websites for fictitious productivity utilities — "AppSuite PDF Editor," "Calendaromatic," "JustAskJacky," "CrystalPDF," "PDF OneStart," "OneStart Browser," "ManualFinder" — each with full marketing pages, fake review carousels, support docs, and an EULA. Traffic is driven by Google Search ads (malvertising) and SEO poisoning against terms like "merge PDF," "calendar app," "free PDF editor," and "AI assistant." Installer bundles are MSI or NSIS packages built around an Electron shell that ships a real (or convincingly real) productivity feature, so victims experience a working application and do not immediately suspect compromise.

## Code Signing and Rebuild Cadence

A defining tradecraft trait is heavy abuse of legitimate Authenticode signing. Unit 42 enumerated 81 distinct code-signing organizations — most are LLCs registered in low-friction jurisdictions (UK Companies House, Panama, US states with anonymous registration) that exist only long enough to obtain an OV code-signing certificate, sign a wave of binaries, and burn before revocation. Certificates rotate every 1–4 weeks; binaries are recompiled with cosmetic changes between rebuilds to invalidate every hash-based reputation lookup. Roughly 100 distinct variants observed across the 4,000+ samples reflect template families rather than truly different malware.

## Execution Chain

1. **Initial Access.** Victim clicks a sponsored search result or social-media ad, lands on a polished product page, downloads an MSI/NSIS installer. 2. **Install-time Persistence.** The installer drops the Electron application into `%LOCALAPPDATA%\Programs\<AppName>\` and registers a scheduled task (e.g., `\Microsoft\Windows\<AppName>Update`, `\<AppName>SchedulerTask`) that runs the main binary with a benign-looking flag at logon and every 1–6 hours. 3. **Dormancy.** The first executions perform no malicious activity. Telemetry is minimal — pings to a benign-looking update endpoint to confirm reachability. Dormancy windows of 14–90 days are typical; some samples wait until day-60 to flip. 4. **Activation.** A backend logic flag (date-gated and/or geo-gated) triggers the JavaScript runtime in the Electron app to load a remote payload chunk over HTTPS. Common dispatch URLs use Cloudflare-fronted custom domains and rotating Cloudflare Workers endpoints. The payload is staged as an `.asar`-style archive or a Node `require()`-able blob and executed inside the Electron process to avoid spawning a fresh PE. 5. **Secondary Payloads.** Observed final-stage families include AsyncRAT, Lumma Stealer, StealC, RedLine variants, AnubisStealer, residential-proxy clients (Honeygain-style SDKs repackaged), and bespoke crypto-wallet sweepers. Some samples additionally enroll the host into a click-fraud / ad-fraud botnet. 6. **Discovery and Collection.** Stealers harvest browser cookies, saved passwords (Chromium login data), crypto wallet files (`wallet.dat`, MetaMask localStorage), Discord and Telegram tokens, FTP/SSH client configs, and screenshots. 7. **Exfiltration.** Data is exfiltrated over HTTPS to actor-controlled C2 servers, typically with simple POST of a ZIP archive or chunked JSON.

## C2 Infrastructure

C2 domains follow a recognizable pattern: short, English-word "product" names registered through Namecheap or Porkbun, fronted by Cloudflare, and pointing to VPS instances at low-reputation hosters (Stark Industries, FBW Networks, AS200019, IPXO ranges). TLS certificates are Let's Encrypt or Cloudflare Edge; SAN entries frequently include multiple unrelated "product" hostnames hinting at shared infrastructure across campaign families. Beaconing is HTTPS POST/GET with JSON bodies, jittered randomly 30–300 seconds during active mode and once-per-6-hours during dormancy. No custom protocol — the choice of Electron and JavaScript makes the network behavior identical to any benign Electron app's auto-updater.

## Attribution

Unit 42 attributes the activity to a financially motivated criminal ecosystem rather than a single actor; the certificate-issuance and infrastructure-rotation discipline is consistent with an organized affiliate-style program. No nation-state attribution. Some overlap exists with the operators behind the OneStart browser PUP family and the ManualFinder install-base from 2024.

## Defender Implications

Because every sample is freshly signed and freshly hashed, hash, certificate-thumbprint, and reputation-only controls fail. Behavioral detection on (a) MSI/NSIS installers dropping Electron apps into `%LOCALAPPDATA%\Programs`, (b) scheduled tasks created at install time that execute Electron apps with non-default args, (c) Electron renderer processes making outbound HTTPS POSTs to non-vendor domains after dormancy, and (d) Chromium login-data file reads by non-browser processes are the most durable signals. Application allowlisting and code-signing-issuer allowlisting (rather than block-known-bad) materially reduce exposure.