TamperedChef Hacking Campaign Leverages Common Apps to Deliver Payloads and Gain Remote Access

TamperedChef is an industrial-scale campaign that lures users to malicious, EV-signed fake installers (masquerading as manual readers, PDF editors, games, etc.) distributed via malvertising and search-engine manipulation; the installers drop an XML defining a scheduled task which executes a heavily obfuscated JavaScript backdoor that encrypts communications (XOR + base64), fingerprints machines, and supports remote code execution. Operators use U.S.-registered shell companies to acquire and rotate Extended Validation code-signing certificates, enabling persistence and rapid infrastructure recovery after takedowns; the campaign primarily affects U.S. victims, concentrated in healthcare, construction, and manufacturing.