Security Magic

DragonsGate Loader analysis: TamperedChef/EvilAI installers, anti-analysis techniques, server-side gating, YARA rules and IOCs. Research update | November 11, 2026 During ongoing investigation into the TamperedChef / EvilAI ecosystem, we have continued to encounter suspicious application installers distributed through gated advertising campaigns . These campaigns can deliver apparently functional PDF, recipe, and other utility applications while using a separate installer-stage mechanism to contact remote infrastructure and potentially retrieve additional content. We are tracking this evolving downloader mechanism under the research name DragonsGate Loader . This is our name for the installer-side delivery and gating behavior—not a claim that every application bearing these traits is a separate malware family or that the final payload has been recovered. Distribution: The Ad Click Still Matters Our observations continue to suggest that the advertising referral p...

UFile | Search Hijacker — Technical Analysis Malware research / technical case study UFile: Signed PDF Utility Delivering an In-Memory Chrome Search Hijacker A .NET installer distributed through an advertising redirect downloads a functional PDF utility, retrieves an encrypted .NET stage, and modifies Chrome search-provider configuration to use an operator-supplied search destination. Search hijacking reproduced Analysis: October 30, 2026 Platform: Windows / Google Chrome Evidence: PE, Authenticode, dnSpy exports, Fiddler SAZ, Frida, controlled rerun Executive summary Distribution Execution chain Chrome modification Indicators Assessment Executive summary Classification: Browser/search hijacker delivered through a signed PDF utility installation chain. The original executable is signed by FAIRLIE LIMITED. Its first-stage installer obtains an application ZIP from alyclick.com ; the installed application requests an encrypted second-stage payload from api.catchasail.com , decrypts ...

CookUp: Suspicious Server-Gated Installer and Loader Analysis Malware Research / Technical Analysis Inside CookUp: A Suspicious Server-Gated Installer and In-Memory Loader CookUp is a recipe application distributed by an installer that also contains a suspicious, server-controlled remote-loading workflow. The installer drops/installs cookup.exe, a .NET recipe application with a limited JSON-based recipe database; in the observed installation, that application appeared functional and benign. The separate Go-based installer can activate a downloader and contains code for processing and loading native PE modules. No authentic second-stage payload was recovered, and malicious activity has not been established. Updated IOC list of high confidence related IOCs: Security Magic GIthub TamperedChef 2026 IOC list Additional Research: Squiblydoo Report Another report I made, tenatively calling this Dragons Gate Loader Research date: October 29, 2026 · Platform: Windows 11 FLAR...