A new report reveals a malicious campaign using Google Ads to promote a fake PDF editor, which covertly installs the TamperedChef infostealer.

The TamperedChef malware campaign uses trojanized apps and digitally signed binaries to steal browser data. Attackers use SEO poisoning to trick users into downloading.

The TamperedChef malware campaign used a trojanized PDF editor, delivered via malvertising, to stealthily harvest browser credentials after operating undetected for two months.

The TamperedChef malware campaign is actively distributing payloads via fake software installers and forged digital certificates, primarily targeting users searching for utilities.

Acronis exposed TamperedChef, a global campaign using US shell companies to sign trojanized apps. The malware deploys a stealthy, obfuscated JavaScript backdoor via a scheduled task for long-term persistence.