# TamperedChef (EvilAI) Activity Clusters — Trojanized Productivity Apps Deliver RATs/Stealers via Malvertising; 4,000+ Samples, 81 Code-Signing Orgs Tracked (Unit 42)

> Palo Alto Unit 42 documented three overlapping activity clusters (CL-CRI-1089, CL-UNK-1090, CL-UNK-1110) corresponding to the public TamperedChef / EvilAI threat. The operation distributes trojanized productivity software — PDF editors, calendars, ZIP extractors, AI helpers — through malvertising and professionally built lookalike sites; binaries are Authenticode-signed by short-lived shell corporations, rebuilt every 1–4 weeks to defeat hash detection, and remain dormant for weeks-to-months before fetching secondary payloads such as infostealers, RATs, and residential-proxy clients. Unit 42 tracked 4,000+ samples, ~100 unique variants, and 81 code-signing organizations across the clusters, with named campaigns including AppSuite PDF, Calendaromatic, JustAskJacky, and CrystalPDF.

- **Published:** 2026-05-20T12:00:00Z
- **Last reviewed:** 2026-05-20T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0541
- **ID:** TL-2026-0541
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** TamperedChef
- **Detections:** 9 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)

## Description

## Overview

TamperedChef (also tracked as EvilAI, ManualFinder, OneStart) is a long-running, financially-motivated malware-distribution operation that has been active since at least mid-2023. Palo Alto Unit 42's May 2026 report consolidated the public ecosystem into three Unit 42 activity clusters — CL-CRI-1089, CL-UNK-1090, CL-UNK-1110 — based on overlaps in code-signing certificates, Electron application boilerplate, install-time scheduled tasks, and a shared post-install command-and-control choreography. The cluster naming is operational; multiple vendors (Truesec, G DATA, Field Effect, Expel) have published overlapping subsets of the same activity under different brand names.

## Distribution and Social Engineering

The operators run thousands of professionally designed lookalike websites for fictitious productivity utilities — "AppSuite PDF Editor," "Calendaromatic," "JustAskJacky," "CrystalPDF," "PDF OneStart," "OneStart Browser," "ManualFinder" — each with full marketing pages, fake review carousels, support docs, and an EULA. Traffic is driven by Google Search ads (malvertising) and SEO poisoning against terms like "merge PDF," "calendar app," "free PDF editor," and "AI assistant." Installer bundles are MSI or NSIS packages built around an Electron shell that ships a real (or convincingly real) productivity feature, so victims experience a working application and do not immediately suspect compromise.

## Code Signing and Rebuild Cadence

A defining tradecraft trait is heavy abuse of legitimate Authenticode signing. Unit 42 enumerated 81 distinct code-signing organizations — most are LLCs registered in low-friction jurisdictions (UK Companies House, Panama, US states with anonymous registration) that exist only long enough to obtain an OV code-signing certificate, sign a wave of binaries, and burn before revocation. Certificates rotate every 1–4 weeks; binaries are recompiled with cosmetic changes between rebuilds to invalidate every hash-based reputation lookup. Roughly 100 distinct variants observed across the 4,000+ samples reflect template families rather than truly different malware.

## Execution Chain

1. **Initial Access.** Victim clicks a sponsored search result or social-media ad, lands on a polished product page, downloads an MSI/NSIS installer.
2. **Install-time Persistence.** The installer drops the Electron application into `%LOCALAPPDATA%\Programs\<AppName>\` and registers a scheduled task (e.g., `\Microsoft\Windows\<AppName>Update`, `\<AppName>SchedulerTask`) that runs the main binary with a benign-looking flag at logon and every 1–6 hours.
3. **Dormancy.** The first executions perform no malicious activity. Telemetry is minimal — pings to a benign-looking update endpoint to confirm reachability. Dormancy windows of 14–90 days are typical; some samples wait until day-60 to flip.
4. **Activation.** A backend logic flag (date-gated and/or geo-gated) triggers the JavaScript runtime in the Electron app to load a remote payload chunk over HTTPS. Common dispatch URLs use Cloudflare-fronted custom domains and rotating Cloudflare Workers endpoints. The payload is staged as an `.asar`-style archive or a Node `require()`-able blob and executed inside the Electron process to avoid spawning a fresh PE.
5. **Secondary Payloads.** Observed final-stage families include AsyncRAT, Lumma Stealer, StealC, RedLine variants, AnubisStealer, residential-proxy clients (Honeygain-style SDKs repackaged), and bespoke crypto-wallet sweepers. Some samples additionally enroll the host into a click-fraud / ad-fraud botnet.
6. **Discovery and Collection.** Stealers harvest browser cookies, saved passwords (Chromium login data), crypto wallet files (`wallet.dat`, MetaMask localStorage), Discord and Telegram tokens, FTP/SSH client configs, and screenshots.
7. **Exfiltration.** Data is exfiltrated over HTTPS to actor-controlled C2 servers, typically with simple POST of a ZIP archive or chunked JSON.

## C2 Infrastructure

C2 domains follow a recognizable pattern: short, English-word "product" names registered through Namecheap or Porkbun, fronted by Cloudflare, and pointing to VPS instances at low-reputation hosters (Stark Industries, FBW Networks, AS200019, IPXO ranges). TLS certificates are Let's Encrypt or Cloudflare Edge; SAN entries frequently include multiple unrelated "product" hostnames hinting at shared infrastructure across campaign families. Beaconing is HTTPS POST/GET with JSON bodies, jittered randomly 30–300 seconds during active mode and once-per-6-hours during dormancy. No custom protocol — the choice of Electron and JavaScript makes the network behavior identical to any benign Electron app's auto-updater.

## Attribution

Unit 42 attributes the activity to a financially motivated criminal ecosystem rather than a single actor; the certificate-issuance and infrastructure-rotation discipline is consistent with an organized affiliate-style program. No nation-state attribution. Some overlap exists with the operators behind the OneStart browser PUP family and the ManualFinder install-base from 2024.

## Defender Implications

Because every sample is freshly signed and freshly hashed, hash, certificate-thumbprint, and reputation-only controls fail. Behavioral detection on (a) MSI/NSIS installers dropping Electron apps into `%LOCALAPPDATA%\Programs`, (b) scheduled tasks created at install time that execute Electron apps with non-default args, (c) Electron renderer processes making outbound HTTPS POSTs to non-vendor domains after dormancy, and (d) Chromium login-data file reads by non-browser processes are the most durable signals. Application allowlisting and code-signing-issuer allowlisting (rather than block-known-bad) materially reduce exposure.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1588 Obtain Capabilities
- T1587 Develop Capabilities
- T1608 Stage Capabilities
- T1189 Drive-by Compromise
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1569 System Services
- T1053 Scheduled Task/Job
- T1547 Boot or Logon Autostart Execution
- T1553 Subvert Trust Controls
- T1036 Masquerading
- T1497 Virtualization/Sandbox Evasion
- T1027 Obfuscated Files or Information
- T1564 Hide Artifacts
- T1555 Credentials from Password Stores
- T1539 Steal Web Session Cookie
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1518 Software Discovery
- T1005 Data from Local System
- T1113 Screen Capture
- T1071 Application Layer Protocol
- T1573 Encrypted Channel
- T1105 Ingress Tool Transfer
- T1090 Proxy
- T1102 Web Service
- T1041 Exfiltration Over C2 Channel
- T1496 Resource Hijacking

## Sources

- [Tracking TamperedChef Clusters via Certificate and Code Reuse](https://unit42.paloaltonetworks.com/tracking-tampered-chef-clusters/)
- [TamperedChef: Malicious PDF Editor Campaign](https://www.truesec.com/hub/blog/tamperedchef-fake-pdf-editor-leads-to-infostealer)
- [G DATA: EvilAI — when AI helpers turn into malware](https://www.gdatasoftware.com/blog/2025/10/evilai-malware)
- [Field Effect: ManualFinder and TamperedChef infection chain](https://fieldeffect.com/blog/tamperedchef-pdf-editor-malware)
- [Expel: OneStart PUP-to-malware pivot](https://expel.com/blog/onestart-browser-pup-malware/)
- [BleepingComputer: Fake PDF editor pushes information-stealing malware](https://www.bleepingcomputer.com/news/security/fake-pdf-editor-pushes-tamperedchef-infostealer-via-google-ads/)
- [Microsoft Threat Intelligence: Code-signing abuse by malvertising operators](https://www.microsoft.com/security/blog/threat-intelligence)
- [MITRE ATT&CK: Code Signing (T1553.002)](https://attack.mitre.org/techniques/T1553/002/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0541