Tag: evilai

3 Attack Reports | 0 Vulnerabilities

Attack reports

Tracking TamperedChef Clusters via Certificate and Code Reuse

Multiple threat clusters designated as CL-CRI-1089, CL-UNK-1090, and CL-UNK-1110 have been distributing trojanized productivity software through malicious advertising campaigns since 2023. These applications, including PDF editors, calendars, and compression tools, appear legitimate but contain rem…
information stealers
justaskjacky
tamperedchef
evilai
calendaromatic
code-signing abuse
2026-05-20
appsuite pdf
cl-cri-1089
cl-unk-1090
crystalpdf
docuflex
fileease
gifsmakerpro
gocookmate
justconvertfiles
malvertising campaigns
manualreaderpro
manualzpdf
onezip
pdfpilot
pdfprime
rapidoc
rocketpdfpro
screensrecorder
shinypdf
swiftnav
trojanized productivity software
zipmakerpro
Published: May 20, 2026
Linked vulnerabilities : CVE-2026-1731 (CVSS 9.9)
Downloadable IOCs: 3

Fake Online Speedtest Application

An analysis of several Windows applications masquerading as legitimate utilities reveals a covert malware operation. These apps, including fake speed testers and AI search tools, install a Node.js runtime and execute obfuscated JavaScript via scheduled tasks. The malware communicates with a command…
node.js
scheduled tasks
evilai
fake applications
2025-09-25
javascript payload
Published: September 25, 2025
Downloadable IOCs: 170

AI-Generated Code and Fake Apps Used for Far-Reaching Attacks

A new malware campaign called EvilAI is spreading globally by disguising itself as legitimate AI-enhanced productivity tools. The malware uses AI-generated code and professional interfaces to evade detection, targeting organizations across sectors like manufacturing, government, and healthcare. It …
obfuscation
persistence
node.js
trojan
credential theft
command and control
2025-09-12
ai-generated code
evilai
fake applications
Published: September 12, 2025
Downloadable IOCs: 14
Click here to see more Attack Reports