TamperedChef Malware Disguised as PDF Editor Hijacks Browser Credentials and Opens Backdoors
A newly identified malware campaign, termed TamperedChef, has been discovered targeting European organizations by posing as a legitimate PDF editor application. This information comes from recent findings by WithSecure’s Strategic Threat Intelligence &…
A newly identified malware campaign, termed TamperedChef, has been discovered targeting European organizations by posing as a legitimate PDF editor application. This information comes from recent findings by WithSecure’s Strategic Threat Intelligence & Research Group.
The campaign highlights the use of convincing advertising tactics and fully operational decoy applications to acquire sensitive credentials and establish persistent backdoor access.
Users searching for free PDF editing software encountered malicious advertisements redirecting them to attacker-controlled download sites.
The payload was delivered via a Microsoft Installer (MSI) package, which displayed an End User License Agreement (EULA) dialog, creating a facade of legitimacy and evading automated security detection systems.
The installation process did not require administrative privileges, enhancing its effectiveness in corporate environments with restricted user permissions.
Once installed, the malware established persistence through autorun registry entries, ensuring automatic launch at system logon.
This information comes from recent findings by WithSecure’s Strategic Threat Intelligence & Research Group.
The AppSuite PDF Editor was developed using NodeJS and packaged as an Electron application, functioning as a full-featured Chromium-based browser.
The malicious functionality was primarily in two components: pdfeditor.js , a heavily obfuscated JavaScript file for both the user interface and malicious activities, and Utilityaddon.node , a custom NodeJS module for manipulating registry entries and scheduled tasks.
The application functioned as expected for nearly two months, providing legitimate PDF editing capabilities through web content hosted at pdf-tool.appsuites.ai . This dormancy period helped avoid detection while establishing trust.
On August 21, 2025, the embedded payload activated, collecting browser-stored credentials from infected systems. The activation revealed the campaign’s intent, leading to the release of sanitized versions (1.0.40 and 1.0.41) with malicious code removed. However, these versions continued connecting to attacker-controlled infrastructure.
Research indicated the existence of AppSuite Print, a similar decoy application, and the emergence of S3-Forge, identified as the campaign's successor, targeting software developers potentially through Amazon Web Services cloud storage references.
S3-Forge uses NuGet packages distributed via the Squirrel framework, incorporating app.asar files to bundle malicious components, thus complicating detection.
Organizations impacted by TamperedChef should assume complete compromise of browser-stored credentials. The campaign involved sophisticated planning, including acquiring legitimate code-signing certificates and executing targeted advertising campaigns.
Immediate credential rotation for all affected users. Session invalidation across all corporate systems. Enforcement of approved software policies in business environments. Disabling browser password storage where feasible. Implementation of enterprise password managers with strict policy controls.
The TamperedChef campaign exemplifies an advanced social engineering tactic, combining legitimate application functionality with long-term compromise strategies. Organizations must remain vigilant against similar deceptive software distribution campaigns as threat actors continue to refine these sophisticated attack methods.
Based on reporting by GBHackers.