TamperedChef Malware Spreads via Fake Software Installers in Ongoing Global Campaign

The TamperedChef campaign continues to spread via fake software installers, with threat actors deploying bogus installers masquerading as popular utilities to entice users into installing malware. According to Acronis Threat Research Unit, the operators rely on social engineering, malvertising, SEO, and abused code-signing certificates issued to shell companies in the US, Panama and Malaysia to sign counterfeit apps and maintain trust.

Acronis told The Hacker News that it uses the name TamperedChef for the malware family to stay consistent with detections across vendors, and the same group is also tracked as BaoLoader by Expel. A typical attack sees users clicking poisoned ads or domains registered on NameCheap, after which the installer drops an XML file to create a scheduled task that launches an obfuscated JavaScript backdoor, which then communicates with an external server over HTTPS to exfiltrate basic metadata.

Telemetry data indicate a higher concentration of infections in the US, with sectors such as healthcare, construction and manufacturing most affected. The end goals remain unclear, with some iterations showing advertising fraud interests, while others suggest monetising access or harvesting data for sale in underground forums. The campaign is described as ongoing, with new artifacts and infrastructure continuing to be detected.