Malware

TamperedChef

Indicators of Compromise 1

Domain s3-forge[.]com

MITRE ATT&CK TTPs 7

T1003
OS Credential Dumping
Credential Access
 T1027
Obfuscated Files or Information
Defense Evasion
 T1059.007
JavaScript
Execution
 T1070.004
File Deletion
Defense Evasion
 T1071.001
Web Protocols
Command And Control
 T1204.002
Malicious File
Execution
 T1566
Phishing
Initial Access

Source Articles

EvilAI Malware Masquerades as AI Tools to Infiltrate Global Organizations
The EvilAI campaign involves threat actors distributing malware disguised as legitimate AI and productivity tools to infiltrate organizations globally. These trojans use valid digital signatures and professional interfaces to evade detection, enabling reconnaissance, data exfiltration, and command-and-control communication. The malware acts as a stager for follow-on payloads, with different variants like BaoLoader and TamperedChef linked to distinct but overlapping infrastructure and objectives.
hacker-news