Trojanized PDF Editor: “TamperedChef” Campaign Bypasses Windows SmartScreen

Sophos X-Ops revealed a malvertising campaign, dubbed TamperedChef, that promotes a Trojanized “AppSuite PDF Editor” to deploy an infostealer to Windows devices. Detected in September 2025, the operation is linked to EvilAI and used Google Ads to reach users searching for software solutions. The campaign has affected over 100 customer systems, with victims spanning at least 19 countries and a notable share in Germany (15%), the United Kingdom (14%), and France (9%).

A key tactic was the use of valid EV code signing certificates to bypass Windows SmartScreen, allowing the malicious executable to install without triggering warnings. The primary payload is an infostealer designed to harvest data from browsers, and researchers warn that credentials stored in browsers may already be compromised for those who installed AppSuite PDF Editor.