Security Magic

DragonsGate Loader analysis: TamperedChef/EvilAI installers, anti-analysis techniques, server-side gating, YARA rules and IOCs. Research update | November 11, 2026 During ongoing investigation into the TamperedChef / EvilAI ecosystem, we have continued to encounter suspicious application installers distributed through gated advertising campaigns . These campaigns can deliver apparently functional PDF, recipe, and other utility applications while using a separate installer-stage mechanism to contact remote infrastructure and potentially retrieve additional content. We are tracking this evolving downloader mechanism under the research name DragonsGate Loader . This is our name for the installer-side delivery and gating behavior—not a claim that every application bearing these traits is a separate malware family or that the final payload has been recovered. Distribution: The Ad Click Still Matters Our observations continue to suggest that the advertising referral p...