TamperedChef (EvilAI) Activity Clusters — Trojanized Productivity Apps Deliver RATs/Stealers via Malvertising; 4,000+ Samples, 81 Code-Signing Orgs Tracked (Unit 42) — Threadlinqs Intelligence
As of 2026-05-30, TamperedChef (EvilAI) Activity Clusters — Trojanized Productivity Apps Deliver RATs/Stealers via Malvertising; 4,000+ Samples, 81 Code-Signing Orgs Tracked (Unit 42) is a high-severity malware threat attributed to TamperedChef, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 30 indicators of compromise.
Threat ID: TL-2026-0541 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Attribution: TamperedChef · FINANCIAL
Palo Alto Unit 42 documented three overlapping activity clusters (CL-CRI-1089, CL-UNK-1090, CL-UNK-1110) corresponding to the public TamperedChef / EvilAI threat. The operation distributes trojanized
## Overview
TamperedChef (also tracked as EvilAI, ManualFinder, OneStart) is a long-running, financially-motivated malware-distribution operation that has been active since at least mid-2023. Palo Alto Unit 42's May 2026 report consolidated the public ecosystem into three Unit 42 activity clusters — CL-CRI-1089, CL-UNK-1090, CL-UNK-1110 — based on overlaps in code-signing certificates, Electron application boilerplate, install-time scheduled tasks, and a shared post-install command-and-control choreography. The cluster naming is operational; multiple vendors (Truesec, G DATA, Field Effect, Expel) have published overlapping subsets of the same activity under different brand names.
## Distribution and Social Engineering
The operators run thousands of professionally designed lookalike websites for fictitious productivity utilities — "AppSuite PDF Editor," "Calendaromatic," "JustAskJacky," "CrystalPDF," "PDF OneStart," "OneStart Browser," "ManualFinder" — each with full marketing pages, fake review carousels, support docs, and an EULA. Traffic is driven by Google Search ads (malvertising) and SEO poisoning against terms like "merge PDF," "calendar app," "free PDF editor," and "AI assistant." Installer bundles are MSI or NSIS packages built around an Electron shell that ships a real (or convincingly real) productivity feature, so victims experience a working application and do not immediately suspect compromise.
## Code Signing and Rebuild Cadence
A defining tradecraft trait is heavy abuse of legitimate Authenticode signing. Unit 42 enumerated 81 distinct code-signing organizations — most are LLCs registered in low-friction jurisdictions (UK Companies House, Panama, US states with anonymous registration) that exist only long enough to obtain an OV code-signing certificate, sign a wave of binaries, and burn before revocation. Certificates rotate every 1–4 weeks; binaries are recompiled with cosmetic changes between rebuilds to invalidate every hash-based reputation lookup. Roughly 100 distinct variants observed across the 4,000+ samples reflect template families rather than truly different malware.
## Execution Chain
1. **Initial Access.** Victim clicks a sponsored search result or social-media ad, lands on a polished product page, downloads an MSI/NSIS installer.
2. **Install-time Persistence.** The installer drops the Electron application into `%LOCALAPPDATA%\Programs\<AppName>\` and registers a scheduled task (e.g., `\Microsoft\Windows\<AppName>Update`, `\<AppName>SchedulerTask`) that runs the main binary with a benign-looking flag at logon and every 1–6 hours.
3. **Dormancy.** The first executions perform no malicious activity. Telemetry is minimal — pings to a benign-looking update endpoint to confirm reachability. Dormancy windows of 14–90 days are typical; some samples wait until day-60 to flip.
4. **Activation.** A backend logic flag (date-gated and/or geo-gated) triggers the JavaScript runtime in the Electron app to load a remote payload chunk over HTTPS. Common dispatch URLs use Cloudflare-fronted custom domains and rotating Cloudflare Workers endpoints. The payload is staged as an `.asar`-style archive or a Node `require()`-able blob and executed inside the Electron process to avoid spawning a fresh PE.
5. **Secondary Payloads.** Observed final-stage families include AsyncRAT, Lumma Stealer, StealC, RedLine variants, AnubisStealer, residential-proxy clients (Honeygain-style SDKs repackaged), and bespoke crypto-wallet sweepers. Some samples additionally enroll the host into a click-fraud / ad-fraud botnet.
6. **Discovery and Collection.** Stealers harvest browser cookies, saved passwords (Chromium login data), crypto wallet files (`wallet.dat`, MetaMask localStorage), Discord and Telegram tokens, FTP/SSH client configs, and screenshots.
7. **Exfiltration.** Data is exfiltrated over HTTPS to actor-controlled C2 servers, typically with simple POST of a ZIP archive or chunked JSON.
## C2 Infrastructure
C2 domains fol
Weaknesses (CWE)
CWE-506, CWE-829, CWE-494
Target sectors: technology, education, financial, healthcare, retail, media, general_consumer
Target regions: North America, Europe, Asia-Pacific, Latin America
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 30 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1583, T1588, T1587, T1608, T1189, T1204, T1204, T1059, T1569, T1053