Tag: javascript payload

2 Attack Reports | 0 Vulnerabilities

Attack reports

Cooking up trouble: How TamperedChef uses signed apps to deliver stealthy payloads

The TamperedChef campaign is a global malvertising and SEO operation that distributes seemingly legitimate software with valid code signing to trick users into executing malicious installers. These fake applications mimic common software and establish persistence through scheduled tasks, delivering…
social engineering
malvertising
persistence
javascript
remote access
scheduled tasks
seo
code-signing
javascript payload
2025-11-20
shell companies
2025-11-26
code-signing certificates
signed applications
Published: November 26, 2025
Downloadable IOCs: 0

Fake Online Speedtest Application

An analysis of several Windows applications masquerading as legitimate utilities reveals a covert malware operation. These apps, including fake speed testers and AI search tools, install a Node.js runtime and execute obfuscated JavaScript via scheduled tasks. The malware communicates with a command…
node.js
scheduled tasks
evilai
fake applications
2025-09-25
javascript payload
Published: September 25, 2025
Downloadable IOCs: 170
Click here to see more Attack Reports