{"id":73048,"date":"2026-02-04T07:06:02","date_gmt":"2026-02-03T23:06:02","guid":{"rendered":"http:\/\/www.upgrademag.com\/web\/?p=73048"},"modified":"2026-01-30T09:07:55","modified_gmt":"2026-01-30T01:07:55","slug":"tamperedchef-serves-bad-ads-with-infostealers-as-the-main-course","status":"publish","type":"post","link":"http:\/\/www.upgrademag.com\/web\/2026\/02\/04\/tamperedchef-serves-bad-ads-with-infostealers-as-the-main-course\/","title":{"rendered":"TamperedChef serves bad ads, with infostealers as the main course"},"content":{"rendered":"

Sophos<\/a>, a global leader of innovative security solutions for defeating cyberattacks, recently identified a\u00a0malvertising\u00a0campaign distributing an infostealer dubbed TamperedChef \u2013 believed to be part of a wider campaign known as\u00a0EvilAI.\u00a0<\/strong><\/p>\n

Previous coverage\u00a0of this campaign suggests it began on June 26, 2025, with many of the associated websites being registered or first identified on that date. The sites were promoting a trojanized PDF editing application called\u00a0AppSuite PDF Editor\u00a0via Google Ads. This application appeared legitimate to users, but silently deployed an infostealer upon installation, targeting Windows devices.<\/p>\n

Through telemetry analysis and threat hunting, Sophos MDR confirmed that over 100 customer systems were affected before our detection and response efforts began.<\/p>\n

According to Sophos telemetry, the majority of victims affected by this campaign are in Germany (~15%), the United Kingdom (~14%), and France (~9%). Although the data highlights a significant concentration in Germany and the UK, it likely reflects the campaign\u2019s widespread global reach, rather than any deliberate targeting of specific regions; we identified 19 countries affected in total.<\/p>\n

Victims of this campaign span a variety of industries, particularly those where operations rely heavily on specialized technical equipment \u2013 possibly because users in those industries frequently search online for product manuals, a behavior that the TamperedChef campaign exploits to distribute malicious software.<\/p>\n

Further investigation revealed that this large, multi-layered distribution network featured multiple advanced tactics, including a delayed activation\/dormancy period, decoy software, staged payload delivery, staged payload delivery, abuse of code-signing certificates, and efforts to evade endpoint protection mechanisms.<\/p>\n

According to\u00a0other researchers, the campaign appears to still be active, with new components still being uncovered and supporting infrastructure continuing to operate (although the domains we observed in our investigations now seem to be inactive).<\/p>\n

Conclusions and recommendations<\/strong><\/p>\n

The threat actors behind the TamperedChef campaign crafted convincing malicious applications, leveraged targeted advertising to achieve large-scale distribution, and secured code-signing certificates. The consequences are severe; users who have installed\u00a0AppSuite PDF Editor\u00a0should consider any credentials stored in their browsers to be compromised.<\/p>\n

Threat actors are well aware that malvertising can be a fruitful and effective infection vector. It\u2019s very possible that the adversaries behind TamperedChef, and others, will cook from a similar recipe in the future.<\/p>\n

Proactive recommended actions<\/strong><\/p>\n