TamperedChef Malware Rises: Deceptive Apps Use Signed Binaries and SEO Poisoning to Hijack Browsers

Field Effect’s Threat Intelligence team has uncovered a new TamperedChef malware wave that uses digitally signed binaries, deceptive packaging, and browser hijackers to deliver malware disguised as ordinary productivity tools. The campaign centres on two trojanised applications, ImageLooker.exe and Calendaromatic.exe, delivered via self-extracting archives and linked to by a malware sample repository as part of the TamperedChef ecosystem.

The researchers note that the executables are built with NeutralinoJS and distributed through deceptive advertising and search engine manipulation, while Microsoft Defender flagged a Potentially Unwanted Application in late September 2025. According to Field Effect, PUAs can act as effective delivery mechanisms for more serious threats, and the campaign leverages multiple digital signers and PUAs to redirect traffic, alter browser settings, and facilitate malware downloads.

Victims are lured through SEO poisoning and deceptive ads, with threat actors creating keyword-stuffed landing pages that rank for queries such as “free PDF editor” or “calendar app for Windows.” Cited tactics include exploiting CVE-2025-0411 to bypass Windows MTW protections, persisting via command-line flags, and exfiltrating browser data and credentials.