TamperedChef (also known as EvilAI) is a widespread threat campaign distributing trojanized productivity applications via malvertising. The threat actors heavily abuse legitimate code-signing certificates and employ delayed execution techniques to evade detection, ultimately deploying information stealers, RATs, or adware onto victim endpoints after a dormancy period.
Code Signing
3 posts
Tracking TamperedChef Clusters via Certificate and Code Reuse Axios Supply Chain Attack Reaches OpenAI macOS Signing Pipeline, Forces Certificate Rotation A supply chain attack involving a compromised version of the Axios library (1.14.1) impacted OpenAI's macOS app signing workflow. The malicious package was executed in a GitHub Actions CI pipeline with access to sensitive code signing certificates, prompting OpenAI to revoke the certificates, rebuild applications, and force user updates, though no downstream compromise or data exfiltration was observed.
Storm-2561 uses SEO poisoning to distribute fake VPN clients for credential theft Storm-2561 is conducting a credential theft campaign leveraging SEO poisoning to distribute fake enterprise VPN clients. The attack utilizes digitally signed payloads and DLL side-loading to deploy the Hyrax infostealer, which harvests VPN credentials and configuration data before redirecting victims to legitimate software to evade detection.
