Threat actors abuse Google Ads to distribute a trojanized PDF editor, deploying TamperedChef malware to compromise user systems.
Windows users around the world are seriously threatened by a malvertising campaign that was discovered in September 2025.
In order to spread the deadly information-stealing virus known as TamperedChef, attackers made phony PDF editing programs and advertised them via Google Ads.
By taking advantage of popular search behaviors, the malware targets individuals looking for appliance manuals and PDF editing tools online, spreading silently throughout many businesses and geographical areas.
On June 26, 2025, threat actors launched many look-alike websites advertising a trojanized program called AppSuite PDF Editor, marking the official start of the operation.
Although users thought they were installing trustworthy software, the installer really included malicious malware that was concealed and intended to capture private browser information.
The timing of this attack is especially misleading; the virus was dormant for around 56 days, which corresponds with the regular cycles of advertising campaigns.
The malware was able to infect as many machines as possible before exhibiting dangerous behavior because of this calculated delay. TamperedChef’s infection method exhibits complex multi-stage distribution strategies intended to avoid discovery.
On websites like Google and Bing, users start by clicking on malicious ads that show up in search results.
They download the Appsuite-PDF.msi installer from these advertisements, which take users to fraudulent websites like fullpdf.com and pdftraining.com, compromising security.
This file dumps an obfuscated JavaScript file, another executable, and a setup executable named PDFEditorSetup.exe when it is executed.
In order to ensure that the virus endures system restarts, PDFEditorSetup.exe then quietly develops persistence by generating registry entries and Windows scheduled tasks.
Lastly, the installer launches PDF Editor.exe, the infostealer component itself, which started collecting browser passwords, cookies, and autofill data on August 21, 2025.
By misusing valid code-signing certificates from US- and Malaysian-registered organizations, the attackers improved their operation even more. This allowed their malicious files to evade Windows SmartScreen security and seem reliable to gullible consumers.
This multi-layered infection process demonstrates how contemporary threat actors enhance infection success and reduce early detection by combining malvertising, software interfaces that appear authentic, and system-level evasion strategies.
