TamperedChef Malware Disguised as PDF Editor Hijacks Browser Credentials and Opens Backdoors

A campaign dubbed TamperedChef has compromised European organisations by masquerading as a legitimate PDF editor application, according to WithSecure’s Strategic Threat Intelligence & Research Group (STINGR). It spread via a Microsoft Installer (MSI) package that displayed an End User License Agreement to appear legitimate while evading automated security detection, and required no administrative privileges during installation.

Once installed under the user profile, the malware established persistence through autorun registry entries and began harvesting browser-stored credentials from infected systems on 21 August 2025, with sanitized updates (1.0.40 and 1.0.41) released but retaining backdoor capabilities. The campaign’s architecture centres on AppSuite PDF Editor, built with NodeJS and packaged as an Electron app, with main payloads in pdfeditor.js and Utilityaddon[.]node, and web content hosted at pdf-tool[.]appsuites[.]ai. A successor variant, S3-Forge, uses NuGet packages via the Squirrel framework and continues to pursue backdoor access.