TAMPEREDCHEF MALWARE SPREADS VIA FAKE SOFTWARE INSTALLERS IN ONGOING GLOBAL CAMPAIGN

Summary from the TLDR InfoSec newsletter

TamperedChef (aka BaoLoader) distributes JavaScript backdoors through fake software installers signed with fraudulent certificates from shell companies in the US, Panama, and Malaysia. Delivered via malvertising and SEO poisoning targeting searches for PDF editors and product manuals, the malware establishes persistence through scheduled tasks that execute obfuscated JavaScript, which beacons encrypted system data to C2 servers, with primary infections concentrated in US healthcare, construction, and manufacturing sectors. Security teams should implement application allowlisting, monitor for suspicious scheduled tasks executing JavaScript payloads, validate code-signing certificates against threat intelligence, and restrict access to product manuals through authorized channels only.