TamperedChef infostealer delivered through fraudulent PDF Editor

Threat actors have been distributing a convincing PDF editing app that delivers an info-stealing malware dubbed TamperedChef, via Google ad-promoted websites advertising AppSuite PDF Editor. According to Truesec, the campaign spans more than 50 domains hosting deceiving apps signed with fraudulent certificates issued by at least four companies, and the operators appear to wait for ads to run their course before activating malicious components.

The malware was verified by VirusTotal on 15 May, but the malicious payload was activated when an update on 21 August unleashed capabilities to collect credentials and web cookies. Researchers note that TamperedChef is delivered with the “-fullupdate” argument for the PDF editor’s executable and that the software checks for installed security agents and queries browser databases using the DPAPI.

Truesec found evidence that the threat actor relied on Google advertising to promote the malicious program, delivering the infostealer just four days before typical 60‑day ad campaign expiration. The PDF Editor versions were signed by certificates from at least four companies, including ECHO Infini SDN BHD, GLINT By J SDN. BHD, and SUMMIT NEXUS Holdings LLC, BHD, illustrating a highly orchestrated operation designed to maximise distribution.