hacker-news · Crawled Jul 25, 2026

EvilAI Malware Masquerades as AI Tools to Infiltrate Global Organizations

1 IoCs 2 Malware

AI Summary

The EvilAI campaign involves threat actors distributing malware disguised as legitimate AI and productivity tools to infiltrate organizations globally. These trojans use valid digital signatures and professional interfaces to evade detection, enabling reconnaissance, data exfiltration, and command-and-control communication. The malware acts as a stager for follow-on payloads, with different variants like BaoLoader and TamperedChef linked to distinct but overlapping infrastructure and objectives.

AI-extracted · verify before operational use

Extracted Entities 2 found

Malware BaoLoader → Malware TamperedChef →

Indicators of Compromise 1 extracted

Type	Value	Detail
Domain	s3-forge[.]com	Details →

MITRE ATT&CK TTPs 7 techniques

T1003 OS Credential Dumping · Credential Access T1027 Obfuscated Files or Information · Defense Evasion T1059.007 JavaScript · Execution T1070.004 File Deletion · Defense Evasion T1071.001 Web Protocols · Command And Control T1204.002 Malicious File · Execution T1566 Phishing · Initial Access