New TamperedChef Attack Uses Weaponized PDF Editor to Steal Sensitive Data and Login Credentials

Cybersecurity researchers at Truesec have uncovered a sophisticated malware campaign distributing a weaponized PDF editor under the guise of “AppSuite PDF Editor,” with the operation beginning on 26 June 2025. The malicious installer prompts a EULA, downloads the core payload, and establishes persistence via a Run registry key in HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run, while its loader coordinates update checks and loads an obfuscated payload to enable numerous –cm arguments.

In August 2025, infected systems received commands activating the TamperedChef infostealer to steal data by querying browser databases with DPAPI and terminating browser processes to access login credentials. The campaign also leverages Google Ads for promotion, with traffic revealing at least five campaign IDs and referrers, and it spanned 56 days before malicious activation, aligning with typical ad cycles.

Digital signatures on variants are tied to entities such as ECHO Infini SDN BHD and SUMMIT NEXUS Holdings LLC, with links to other suspicious firms and ties to BYTE Media noted by the researchers.