TamperedChef Malvertising Uses US Shell Companies to Sign Trojanized Apps with Valid Certificates, Deploying Stealth Backdoor

Acronis’ Threat Research Unit (TRU) has uncovered a global malvertising and SEO-poisoning campaign, dubbed TamperedChef, that distributes fully functional but trojanized applications signed with certificates purchased through U.S.-based shell companies. Once installed, the fake apps deploy a malicious task.xml and a scheduled task that runs every 24 hours with a random delay, enabling stealthy persistence and remote access.

The threat uses heavily obfuscated JavaScript backdoors and two variants were found, both employing various obfuscation techniques and enabling core capabilities such as registry manipulation, machine fingerprinting, encrypted communication with the C2, and remote code execution. Acronis telemetry reveals that most victims are in the Americas, with roughly 80% in the United States.

The campaign pushes installers via Bing and Google malvertising, fake download sites and SEO-optimised pages for manuals, PDFs, browsers and even simple games, with a network of generic LLCs like App Interplace LLC and Unified Market Group LLC rotating certificates to sustain re-signing. According to Acronis, the earliest C2 servers used random strings, but by mid to late 2025 they shifted to human-readable names.