TamperedChef: A High-Severity Multi-Stage Infostealer Operation

Summary

TamperedChef Campaign Overview

The TamperedChef campaign represents a sophisticated 2025 malware operation that distributes signed fake PDF tools through SEO-driven malvertising to gain user trust. This high-severity multi-stage infostealer operation targets Windows platforms worldwide, with a unique 56-day dormancy period that allowed malicious applications to function normally before mass activation on August 21, 2025. The TamperedChef malware campaign deployed an obfuscated backdoor designed for credential theft, data exfiltration, and remote access capabilities.

TamperedChef Malware Distribution and Impact

TamperedChef malware operators used shell companies to obtain Extended Validation (EV) certificates and employed rapidly rotating infrastructure to evade detection. The TamperedChef campaign heavily impacted U.S. victims, representing approximately 80% of infections, with significant targeting of healthcare, construction, and manufacturing sectors. The TamperedChef threat demonstrates financially motivated objectives including initial access brokerage, credential theft, and potential ransomware staging capabilities.

TamperedChef Attack Regions and Targeted Industries

The TamperedChef malware operation targeted regions worldwide with primary concentration in the United States. Affected industries include healthcare organizations, construction companies, manufacturing facilities, industrial operations, hospitality businesses, legal firms, non-profit organizations, technology companies, retail establishments, transportation services, agriculture operations, automotive businesses, educational institutions, energy providers, and government agencies. The TamperedChef campaign specifically exploited users searching for product manuals and PDF editing utilities through poisoned search results and malicious SEO-optimized advertisements.

Attack Details

TamperedChef Initial Infection Vector

The TamperedChef campaign began in late June 2025, utilizing highly convincing malvertising techniques with fake, signed installers masquerading as legitimate productivity tools such as PDF editors. TamperedChef malware distribution relied on poisoned search results and malicious SEO-optimized advertisements targeting users searching for product manuals or PDF editing utilities. The TamperedChef installers were signed with legitimate Extended Validation certificates obtained through U.S. shell companies including Stratus Core Digital LLC and DataX Engine LLC, as well as Malaysian entities, lending credibility to the malicious applications.

TamperedChef Dormancy Period and Activation Mechanism

A defining characteristic of the TamperedChef malware is its deliberate 56-day dormancy period. During this TamperedChef dormancy phase, the fake PDF applications provided genuine PDF-editing functionality while covertly establishing persistence mechanisms. This TamperedChef delay strategy, aligned with common Google Ads campaign cycles, enabled the malware to evade sandbox analysis and achieve broad distribution before mass activation. The TamperedChef payload was triggered using the “–fullupdate” command on August 21, 2025, initiating the malicious activities across infected systems simultaneously.

TamperedChef Backdoor Deployment and Capabilities

Upon TamperedChef activation, the malware drops task.xml to create a scheduled task that executes a heavily obfuscated JavaScript backdoor. The TamperedChef backdoor runs silently in the background, forcibly terminates browser processes, and abuses Windows Data Protection API (DPAPI) to decrypt stored passwords, cookies, and authentication tokens. The TamperedChef malware gathers comprehensive machine metadata including system information, installed software, and security configurations. Stolen data is transmitted to attacker-controlled Command and Control (C2) servers using XOR encryption with random keys to obfuscate exfiltration activities.

TamperedChef Remote Access and Persistence

The TamperedChef backdoor supports remote code execution capabilities, enabling persistent access to compromised systems. TamperedChef operators can execute arbitrary commands, deploy additional payloads, and maintain long-term access for credential theft, data exfiltration, and potential ransomware deployment. The TamperedChef persistence mechanisms include registry key modifications at HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PDFEditorUpdater, scheduled tasks named “PDFEditorScheduledTask,” and file placement in %LOCALAPPDATA%\Programs\PDFEditor\ directories.

TamperedChef Infrastructure and Attribution

TamperedChef operators demonstrate strong industrialization capabilities, utilizing U.S. shell companies and Malaysian entities to obtain legitimate Sectigo Extended Validation certificates, which they rapidly rotate after revocation. The TamperedChef infrastructure employs short-lived NameCheap-registered domains and evolving Command and Control naming conventions, transitioning from Domain Generation Algorithm (DGA)-style strings to human-readable names. While the TamperedChef campaign remains unattributed to specific threat actors, motivations appear financially driven, focusing on initial access brokerage, credential theft, ransomware staging, with possible opportunistic espionage capabilities.

Recommendations

TamperedChef Hunting and Remediation Procedures

Organizations should immediately search for TamperedChef persistence indicators including the registry key HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PDFEditorUpdater, scheduled tasks named “PDFEditorScheduledTask,” and file presence in %LOCALAPPDATA%\Programs\PDFEditor\ directories. These indicators directly align with known TamperedChef Indicators of Compromise (IOC) patterns. For confirmed TamperedChef infections, security teams should implement immediate credential resets across affected user accounts and perform full system reimaging due to the malware’s deep persistence and advanced evasion capabilities. TamperedChef remediation requires comprehensive forensic analysis to identify lateral movement and data exfiltration scope.

TamperedChef Behavioral Detection with EDR Solutions

Implement Endpoint Detection and Response (EDR) solutions tuned specifically for TamperedChef behavioral patterns including browser process termination by non-browser applications, creation of scheduled tasks using XML files, and suspicious JavaScript execution from AppData folders. These detection capabilities address the TamperedChef campaign’s obfuscation techniques and modular tactics effectively. Deploy Microsoft Sysmon with custom detection rules aligned with TamperedChef Tactics, Techniques, and Procedures (TTPs) following documented incident response practices. EDR behavioral monitoring should flag TamperedChef indicators including Windows DPAPI abuse for credential access and XOR-encrypted C2 communications.

TamperedChef Network Infrastructure Blocking

Security teams should block known TamperedChef Command and Control domains including api.mxpanel.com and associated infrastructure at network perimeter layers. Implement DNS security solutions and integrate TamperedChef Indicators of Compromise feeds into Security Information and Event Management (SIEM) systems for automated containment. Monitor HTTPS outbound connections from productivity applications to suspicious domains associated with TamperedChef operations. Network security controls should enforce strict egress filtering to prevent TamperedChef data exfiltration and C2 communications through non-standard ports and protocols.

TamperedChef Application Control Policies

Enforce strict software installation policies allowing only vetted PDF editors and productivity suites through approved corporate channels to prevent TamperedChef malware installation. Block unauthorized software downloads and implement application whitelisting to reduce user exposure to TamperedChef malicious installers. This foundational security control directly prevents the initial infection vectors used by TamperedChef campaigns. Organizations should maintain an approved software catalog and enforce digital signature verification for all executables, specifically validating Extended Validation certificates against revocation lists to detect TamperedChef signed malware.

TamperedChef User Awareness and Security Training

Conduct comprehensive user awareness training addressing TamperedChef social engineering tactics, emphasizing the dangers of downloading free or unknown software alternatives from search engine results. Train employees to recognize TamperedChef malvertising techniques on search engines and understand the risks of clicking sponsored results or advertisements for productivity tools. Emphasize mandatory IT approval processes for all software installations as an industry best practice to prevent TamperedChef infections. Security awareness programs should include specific examples of TamperedChef fake PDF editor distribution and the importance of obtaining software exclusively from official vendor websites or authorized enterprise software repositories.

Indicators of Compromise (IoCs)

TamperedChef Malware SHA256 Hashes

The following SHA256 file hashes are associated with TamperedChef malware samples. Security teams should integrate these TamperedChef IOCs into endpoint protection platforms, SIEM solutions, and threat intelligence feeds for detection and blocking:

Note: Additional TamperedChef SHA256 hashes are available in the complete Indicators of Compromise dataset. The PDF document indicates that remaining IOCs can be accessed on the threat intelligence platform. Organizations should request the complete TamperedChef IOC feed for comprehensive protection.

MITRE ATT&CK TTPs

TamperedChef MITRE ATT&CK Tactics and Techniques

The TamperedChef malware campaign employs numerous techniques mapped to the MITRE ATT&CK framework. Security teams should configure detection rules and behavioral analytics aligned with these TamperedChef TTPs:

References

TamperedChef Threat Intelligence Sources