New TamperedChef Malware Exploits Productivity Tools to Access and Exfiltrate Sensitive Data

A cybersecurity write‑up reports a campaign dubbed “TamperedChef” that exploits trojanised productivity tools to bypass security controls and exfiltrate data. On 22 September 2025, Field Effect researchers flagged two PUAs, ImageLooker.exe and Calendaromatic.exe, delivered via self‑extracting 7‑Zip archives and signed by CROWN SKY LLC, with other signatures including APPSOLUTE and OneStart Technologies LLC.

The artefacts are built on NeutralinoJS and are said to extract their payloads automatically, evading Windows Mark of the Web protections and SmartScreen, potentially exploiting CVE‑2025‑0411 to disable archive warnings.

The campaign uses malware‑as‑a‑service or a code‑signing marketplace to distribute a broad set of seemingly legitimate binaries, and once executed, the samples contact command‑and‑control domains to retrieve additional payloads, establishing persistence via scheduled tasks and registry modifications. They exfiltrate browser credentials, session tokens, and document/configuration data, while network traffic shows connections to residential proxies and adware‑style infrastructures.

The researchers also note Unicode homoglyphs used to encode hidden payloads and the reliance on SEO poisoning and deceptive advertising to lure victims. According to Microsoft Defender, these self‑extracting archives masquerade as productivity tools, enabling long‑term access and data theft.