Loading story…
Threat actors used Google Ads malvertising and look-alike websites to distribute a trojanized Windows application branded as AppSuite PDF Editor, delivering an information-stealing payload tracked as TamperedChef. Sophos X-Ops/MDR investigations reported the operation was first detected in September 2025, with infrastructure activity traced back to late June 2025, when attackers registered multiple spoofed sites to impersonate legitimate PDF-editing and “manual finder” tooling. The campaign exploited common search behavior—particularly users looking for PDF editors and appliance/product manuals—to drive victims to malicious installers that appeared legitimate but silently deployed an infostealer targeting browser-stored data and other sensitive information.
Get the infrastructure and lures behind it.
7 events from the most recent confirmed update back to the earliest known activity.
On publication of the research, Sophos warned that anyone who installed “AppSuite PDF Editor” should assume browser credentials were compromised. The company advised defenders to hunt for the application and review browser download alerts for suspicious activity.
Sophos X-Ops reported that the campaign used valid code-signing certificates, including EV certificates, from Malaysian and US-registered entities to make the malware appear trustworthy and help bypass Windows SmartScreen. The disclosure highlighted the campaign’s use of trusted signing to improve infection success.
Victimology analysis showed the campaign reached at least 19 countries, with higher observed concentrations in Germany, the UK, and France. Sophos noted the geographic pattern may reflect incidental exposure rather than deliberate targeting.
Sophos first identified the campaign in September 2025 during managed detection and response investigations. By that point, the operation had already affected more than 100 customer systems.
After a long delay intended to evade detection, the infostealer component began executing to harvest browser-stored passwords, cookies, and autofill data from victims. Researchers said the delay was about 56 days, matching the lifecycle of typical ad campaigns.
Attackers started using Google Ads and search-result infiltration to lure Windows users to malicious sites hosting a trojanized MSI installer for “AppSuite PDF Editor.” The installer appeared legitimate but was designed to deploy the TamperedChef infostealer through a multi-stage infection chain.
The malvertising operation began when threat actors registered look-alike websites advertising a trojanized Windows application called “AppSuite PDF Editor.” The campaign also used “Manual FinderApp” branding in malware metadata to target users searching for product manuals.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that the **TamperedChef** malware operation, also tracked as **EvilAI**, has distributed trojanized productivity software through malvertising and polished download sites, posing as tools including **Calendaromatic**, **DocuFlex**, **AppSuite PDF**, **OneZip**, **CrystalPDF**, **PDF-Ezy**, and **RapiDoc**. The campaign has been active since early 2023 and uses valid code-signing certificates, delayed second-stage delivery, persistence mechanisms, and stealthy execution to evade detection while deploying adware, browser hijackers, information stealers, RATs, and proxy-style payloads. Unit 42 said it identified more than **4,000 unique samples** and **100+ variants**, with infections observed in more than half of monitored enterprise environments. Analysis of the **rapidoc** subcluster linked the activity to broader fake-app campaigns and highlighted code reuse, certificate rotation, and infrastructure overlap with related **BaoLoader** activity. Researchers described two main branches: a **Calendaromatic** `7zSFX` dropper line tied to shell companies including **CROWN SKY LLC** and **MARKET FUSION INNOVATIONS LLC**, and a **Neutralinojs**-based **RapiDoc** stage-0 line tied to **CANDY TECH LTD**. A recurring tracking artifact was the **GlobalSign GCC R45 EV CodeSigning CA 2020** sub-CA certificate with serial `77BD0E05B7590BB61D4761531E3F75ED`, which was used to connect shell-company activity across Israel, Ukraine, Panama, Malaysia, Estonia, and the United States; researchers also found an unsigned sibling sample communicating with `calendaromatic.com`, suggesting some operators may be dropping code signing to reduce attribution risk.
Jun 29, 2026
Security researchers reported multiple malware campaigns using trojanized utility software—including fake PDF converters, ZIP tools, and a malicious PDF editor—to infect users who arrive via search ads and download portals. Intezer identified two families, **SilentMare** and **HollowMare**, embedded in seemingly legitimate utilities: SilentMare acts as a downloader and foothold, using custom installers, scheduled-task persistence, daily updater check-ins, and AES-encrypted .NET payloads executed in memory, while HollowMare behaves more like a potentially unwanted application that installs browser extensions or hijacks default search settings. Truesec separately described a malicious **Appsuite PDF Editor** delivering **TamperedChef**, reinforcing the use of fake productivity tools as an infection vector. The reporting shows a broader resurgence of Trojan horse delivery through software impersonation, including lures tied to AI-themed branding and homoglyph abuse to make malicious sites and applications appear legitimate. Intezer said SilentMare and HollowMare shared some infrastructure and code-signing certificate procurement patterns, including certificates issued to Israeli entities, but found the evidence insufficient to attribute both families to the same actor. Researchers advised blocking these utilities in enterprise environments because even apparently functional apps may upload user files to untrusted servers, establish persistence, or alter browser behavior without a second-stage payload.
Aug 14, 2026
Threat actors are increasingly leveraging fake websites and bogus software installers to distribute malware, employing advanced techniques such as AI-generated web pages and code-signed malicious applications. One campaign involves the use of the legitimate Syncro remote access tool, where attackers create their own signed builds and distribute them via mass-generated, AI-powered fake websites that closely mimic official application sites. These malicious sites are promoted through search engine optimization and phishing emails, often masquerading as trusted brands like antivirus or password management tools, to trick users into downloading malware-laden installers. Another ongoing global campaign, dubbed TamperedChef, uses counterfeit installers for popular software to deliver JavaScript-based remote access malware. The attackers utilize malvertising, SEO, and abused digital certificates from shell companies to increase the credibility of their malicious payloads. The infrastructure supporting these campaigns is described as industrialized, with operators regularly acquiring new code-signing certificates to evade detection. Both campaigns highlight the growing sophistication and scale of malvertising operations targeting users through deceptive download sites and installer packages.
Jun 29, 2026