New TamperedChef Malware Exploits Productivity Tools to Access and Exfiltrate Sensitive Data
## Cybersecurity: TamperedChef Malware Campaign Analysis
Cybersecurity: TamperedChef Malware Campaign Analysis
On September 22, 2025, a malware campaign named "TamperedChef" was identified exploiting trojanized productivity tools. These tools are disguised as benign applications to bypass security controls and extract sensitive information from targeted systems.
Malware Deployment and Technical Details
Field Effect researchers discovered two malicious applications, ImageLooker.exe and Calendaromatic.exe, delivered via self-extracting 7-Zip archives. The executables were digitally signed by CROWN SKY LLC, known for distributing deceptive samples. The malware uses NeutralinoJS to execute arbitrary JavaScript within a lightweight desktop framework, extracting payloads without user intervention. It likely exploits CVE-2025-0411 to bypass Windows’ security measures.
The campaign utilizes digital signatures from entities such as CROWN SKY LLC and others, indicating potential use of a malware-as-a-service provider or a code-signing marketplace for distribution.
Upon execution, the malware contacts command-and-control domains to retrieve additional payloads, establishing persistence through scheduled tasks and registry modifications. It employs Unicode homoglyphs to encode hidden payloads, bypassing traditional detection methods.
On September 22, 2025, a malware campaign named "TamperedChef" was identified exploiting trojanized productivity tools.
The malware uses NeutralinoJS to interact with native system APIs, allowing covert file system access and process spawning. Network traffic analysis revealed connections to residential proxy services, indicating the use of adware-style infrastructures. Its activities include:
Harvesting browser-stored credentials and session tokens. Exfiltrating document files and configuration data. Redirecting browser traffic to malicious pages.
Organizations should enforce strict code-signing certificate validation, monitor endpoints for new tasks or registry entries, detect outbound connections to malicious domains, and analyze PUAs and self-extracting archives in a sandboxed environment. Traditional defenses may be insufficient; behavior-based detection and robust application allow-listing are recommended.
The TamperedChef campaign exemplifies the exploitation of potentially unwanted applications and digital code signing to evade detection. Heightened scrutiny and behavior-based monitoring are essential to mitigate this threat.
Based on reporting by GBHackers.