TLDR Tech / InfoSec
Tracking TamperedChef Clusters via Certificate and Code Reuse
Unit 42 mapped three TamperedChef (aka EvilAI) clusters distributing trojanized productivity apps (PDF editors, calendars, and ZIP tools) that stay dormant for weeks before pulling second-stage stealers, RATs, or proxy malware, identifying over 4,000 samples across 100 variants by pivoting on code-signing certificate reuse, code overlap, and ad-transparency data. Operators function as advertising and logistics specialists rather than malware experts, registering shell corporations for OV/EV certificates (CL-CRI-1089 burned 34 certs costing $10,000+), running 20,000+ malvertisements, and using LLM-generated distribution sites with visually similar pages but distinct DOM structures. Defenders should deploy updated EDR/XDR and enterprise browsers, harden endpoints against untrusted software installs, hunt for persistence via scheduled tasks and registry Run keys, and revoke tokens plus reset browser-stored credentials on any confirmed infection.
Read the full story