TamperedChef Malware: Fake PDF Editor Stole Credentials After Two Months of Covert Operation

According to WithSecure, researchers uncover a highly sophisticated malware campaign named “TamperedChef” that masquerades as a legitimate PDF editor and infiltrates corporate networks across Europe using malvertising and a decoy AppSuite PDF Editor. The operation remained undetected for nearly two months before the payload activated to harvest browser-stored credentials from numerous systems.

The infection flow began when users searching for a free PDF editor clicked malicious ads that redirected them to attacker-controlled download sites, where a malicious MSI package installed the malware and created autorun registry entries for persistence. The main app, written in NodeJS and packaged as an Electron app, ran PDF Editor.exe while secretly executing obfuscated JavaScript in pdfeditor.js to exfiltrate data.

The payload activated on 21 August 2025, after which infected machines began sending saved usernames and passwords to attacker servers, prompting quick moves by the threat actors to release clean app versions 1.0.40 and 1.0.41, though continued connections to attacker infrastructure kept the infection chain alive. Further decoys, such as AppSuite Print and the S3-Forge project, indicate ongoing development and testing of privilege escalation mechanisms.