TamperedChef Malware Disguised as Fake PDF Editors Steals Credentials and Cookies

Cybersecurity researchers have uncovered a malvertising-driven campaign delivering an information stealer named TamperedChef via a trojanised PDF editor called AppSuite PDF Editor. According to Truesec researchers Mattias Wåhlén, Nicklas Keijser, and Oscar Lejerbäck Wolf, the malware is designed to harvest credentials and web cookies.

German cybersecurity company G DATA also analysed the activity, noting that several bogus sites promote the same installer which then fetches the PDF editor from a server and installs a backdoor with persistence through Windows Registry changes. The campaign appears to have started on 26 June 2025, with updates communicated from 21 August 2025 when machines calling back received instructions that activated TamperedChef’s information-stealing capabilities; Truesec described the ad campaign as lasting around 56 days.

The backdoor supports commands such as --install to create scheduled tasks, --ping to contact a C2, and --check to exfiltrate data from Chromium, OneLaunch and Wave browsers, including credentials, history and cookies. Expel’s analysis is noted as detailing a large ad campaign advertising PDF editors like AppSuite, PDF OneStart and PDF Editor, which in some cases downloaded trojanised apps or transformed hosts into residential proxies.