Google Ads Exploited to Deliver TamperedChef Through Malicious PDF Editor

A sophisticated malvertising campaign named TamperedChef used deceptive domains and Google Ads to distribute a trojanized AppSuite PDF Editor installer, compromising over 100 organizations and 300 systems across 19 countries. The payloads include an infostealer that extracts browser-stored credentials via DPAPI and a persistent backdoor (ManualFinderApp.exe) that communicates with identified C2 domains; actors used fraudulent code-signing certificates and a 56-day dormancy period to evade detection.