Intelligence Insights: October 2025

Tampered Chef serves up a smorgasbord of suspicious activity in this month’s edition of Intelligence Insights

Highlights from September

Debuting at number 1 on our top 10 most prevalent threat list is Tampered Chef, an Electron Node.JS-based threat designed to process steganographic content with arbitrary JavaScript code delivered alongside recipe or calendar-themed lures. We first saw this activity in June 2025, and initially tracked it as a potentially unwanted program (PUP) until our own research and that of other researchers uncovered the application’s suspicious and deceptive qualities. You can read more about Tampered Chef below.

Akira, an opportunistic ransomware group that steals sensitive data and operates a TOR leak site, made the list for the first time sharing spot 8 in a tie. This is the first time we’ve seen a ransomware group in our monthly top 10 list since November 2021.

Latrodectus, a downloader used by adversaries to execute arbitrary commands and deliver additional payloads, made the list this month in a tie for 8th. This is Latrodectus’s second time in the top 10 after its debut on the list in May 2025; it continues to be one of the payloads of choice for ongoing paste-and-run campaigns.

Our final newcomer to the top 10 this month is Rhadamanthys, a stealer written in C++ that is used to steal credentials, cryptocurrency wallets, and browser data, as well as download and execute additional payloads. Rhadamanthys isn’t a new threat—it first appeared in 2022 and Red Canary has been tracking it since that time—but this is the first time it’s made the list. Like Latrodectus, it’s on the list this month as a paste-and-run payload.

This month’s top 10 threats

To track pervasiveness over time, we identify the number of unique customer environments in which we observed a given threat and compare it to what we’ve seen in previous months.

Here’s how the numbers shook out for September 2025:

⬆ = trending up from previous month ⬇= trending down from previous month ➡ = no change in rank from previous month

*Denotes a tie

Tampered Chef savors steganography

We first saw Tampered Chef in early June 2025, as a sudden high-volume wave of activity that we initially classified as a PUP before we took a closer look at its code. We weren’t the only ones doing so; within days of our first seeing it, other researchers published their findings on this threat. Tampered Chef has several suspicious and intentionally deceptive qualities that led us to reassess it as malware. Our updated classification makes it eligible for inclusion in our top 10 list, since we do not typically include adware.

The recipe-themed version of the lure disguises itself as a calorie-counting recipe tool, presented to users via sidebar or banner ads, sometimes on websites with articles that promote the tool.

Image from https://blog.dingusxmcgee.com/blog/2025/06/06/Recipe-For-Adware.html

Interacting with the ad leads to downloading the file Recipe Lister, an archive that unzips to deliver several other resources including the malicious Node.JS Electron application Recipe Finder - Recipe Lister, dynamic link libraries (DLLs), and additional hidden files. Once installed, the app reaches out to suspicious IP addresses, likely to establish command and control (C2) connections.

Tampered Chef’s other suspicious qualities include:

• Steganographic hidden command and control messages, specifically JSON messages that, in addition to containing recipes for meals, include steganographic content in the form of “invisible characters” that are removed, decoded, and executed by Tampered Chef
• File time creation changes, indicative of potential timestomping
• Anti-analysis techniques, including sandbox detection
• The ability to redirect user browser traffic and adjust browser settings

An example that shows the characters included in the JSON message

We are also tracking a similar campaign first observed in September 2025 using a calendar-themed lure—calendaromatic.exe—as described in this blog. In September 2025 we saw both Recipe Lister and Calendaromatic campaign activity. At this time, we’ve decided to track both types of lures under the umbrella of Tampered Chef. As of the end of September 2025, there has been no observed follow-on activity, additional payloads, or command execution. It could be that this threat is indeed adware, or potentially that access has not yet been operationalized.

The Great Trojan Bakeoff : Tampered Chef vs. JustAskJacky vs. Browser Assistant

Tampered Chef is not the only high-volume trojan horse application that we (and others) have observed recently. Another example is JustAskJacky, a family of NodeJS applications that masquerade as a helpful AI or utility tool while conducting reconnaissance and executing arbitrary commands in memory in the background. Another threat we’ve seen mentioned at the same time is Baoloader, which we track as Browser Assistant here at Red Canary. We are currently tracking these three threats as separate and distinct clusters, due to differences in behavior.

Here’s a very brief breakdown of how we’re differentiating them:

2025 Midyear Threat Detection Report

You've read about the top threats of the last month, how about for the last six months? The 2025 Midyear Threat Detection Report provides in-depth analysis and actionable guidance on every page.