TamperedChef infostealer delivered through fraudulent PDF Editor

Security researchers report a widespread, well-orchestrated campaign distributing the TamperedChef infostealer through fraudulent AppSuite PDF Editor apps promoted by Google ads. The malware, activated via a "-fullupdate" argument, steals browser credentials and cookies using DPAPI, can execute arbitrary commands (backdoor behavior), and has been used to enroll victims as residential proxies; investigators identified 50+ deceptive domains, multiple fraudulent code-signing certificates, and provided IoCs to help defenders.