Researchers Uncover Global Malvertising Operation Delivering Delayed-Execution Infostealer

In mid-2025, Sophos Managed Detection and Response (MDR) teams discovered a sophisticated malvertising campaign deploying a credential-stealing infostealer dubbed TamperedChef. The campaign leveraged legitimate Google Ads to lure victims into downloading a trojanized PDF editing tool (AppSuite PDF Editor), which silently installed malware on Windows endpoints. This operation was part of a broader threat cluster referred to internally as EvilAI, and demonstrates a mature threat actor’s use of deceptive advertising, staged payload delivery, obfuscation, and persistence mechanisms to evade detection while harvesting sensitive data.

This article breaks down the attack chain, infection vectors, malware internals, evasion techniques, persistence mechanics, telemetry insights, and recommendations for defenders.

1. Background and Campaign Overview

TamperedChef was identified after MDR telemetry highlighted anomalous installations of a seemingly innocuous PDF editor promoted through online ads. Analysis showed that multiple domains, first registered on June 26, 2025, were used to host fraudulent installers and display malvertising content via Google Ads. The overarching operation spanned at least 19 countries and a diverse set of industry verticals, with notable prevalence in Germany, the UK, and France.

The threat actor’s infrastructure exhibited hallmarks of planned activation windows, staged payload delivery, and sophisticated obfuscation — suggesting both significant resources and a clear understanding of paid ad ecosystems. Instead of immediate malicious behavior upon installation, the campaign incorporated a delayed activation phase designed to evade early detection by ad network scanners and endpoint security products.

1.1 Malvertising as an Attack Vector

Malvertising (malicious advertising) uses legitimate ad networks like Google Ads to distribute exploits or malware. In TamperedChef’s case, ads were displayed to users searching for PDF utilities or appliance manuals. These ads led to deceptive landing pages (e.g., fullpdf.com, pdftraining.com) which mimicked benign software download sites. Upon user download and installation, the installer initiated a multi-stage infection chain.

2. Detailed Attack Chain

The TamperedChef campaign follows a structured multi-stage attack chain:

2.1 Initial Access – Malvertising & Redirects

Search Query Trigger: A user looks for PDF tools or appliance manuals.
Ad Click: A malvertised Google result redirects the user to a deceptive domain.
Download Prompt: Destination page offers the user a free PDF editor setup file (AppSuite-PDF.msi).
User Execution: The victim downloads and runs the installer file.

This flow leverages both paid search ads and SEO poisoning to inflate visibility and increase downloads. Tracking codes in the ad URLs confirm the use of ad network redirects, enhancing both reach and credibility.

2.2 Staging and Execution – Installer Deployment

Once executed:

The installer drops a setup executable (PDFEditorSetup.exe), a heavily obfuscated script (pdfeditor.js), and the main executable (PDF Editor.exe) into the user’s %APPDATA% or %LOCALAPPDATA%.
Registry entries and scheduled tasks are created for persistence (HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PDFEditorUpdater and task names like PDFEditorScheduledTask).

Crucially, the installer does not immediately execute malicious behavior — instead it moves into a dormant staging state, waiting for a remote trigger. This avoids early detection and aligns with typical ad campaign lifecycles (≈56 days).

2.3 Dormancy and Activation

A 106-day overlap between ad campaign duration and payload activation was found through telemetry and domain analysis. Activation occurred on August 21, 2025, after which the malware initiated credential harvesting routines. This delayed activation suggests a deliberate strategy to maximize infections during the ad campaign while minimizing immediate detection.

3. Malware Mechanics: Infostealing and Evasion

3.1 Persistence Mechanisms

TamperedChef ensures long-term presence by:

Adding registry autorun entries for startup execution.
Creating multiple scheduled tasks to re-invoke itself with varied command-line flags (–install, –fullupdate, –check, etc.).
These mechanisms restart the stealer automatically post-reboot, maintaining endurance even after partial remediation efforts.

3.2 Stealing Credentials

Once activated, the main binary conducts several malicious actions:

Security Product Enumeration: The malware queries the registry to detect installed endpoint defenses (Bitdefender, Fortinet, Kaspersky, etc.). This reconnaissance assists in dynamic evasion and suppression of detection triggers.
Credential Theft: By terminating browser processes and using Windows Data Protection API (DPAPI), the malware extracts credentials, session cookies, autofill data, and browsing histories — significantly undermining enterprise and personal security.
Command-and-Control (C2) Communication: The stealer establishes HTTP/S connections to remote hosts, exfiltrating harvested data and possibly retrieving additional instructions or payloads.

3.3 Secondary Payloads and Backdoor Functions

Post-activation, TamperedChef drops an additional executable (e.g., ManualFinderApp.exe), which acts as a secondary backdoor and data exfiltration module. This file mimics benign maintenance software but communicates with known C2 domains — signaling multi-stage control potential.

The naming convention of scheduled tasks associated with this secondary payload mimics legitimate system operations, demonstrating attention to stealth.

4. Code Signing Abuse and Infrastructure Tactics

Sophos observed that the threat actors abused multiple code-signing certificates issued to seemingly unrelated entities (e.g., ECHO Infini SDN. BHD, GLINT By J SDN. BHD). This use of fraudulent or compromised certificates enables the malware payloads to bypass Windows SmartScreen warnings and appear legitimate during installation.

The infrastructure also involved multiple domains and campaign IDs, indicating a scalable malvertising network with broad geographical reach. The domains were often registered en masse and connected via shared network indicators, suggesting centralized control.

5. Evasion and Resistance to Detection

TamperedChef implemented several evasion tactics:

Obfuscated JavaScript and binary code within installers to evade signature-based detection engines.
Delayed activation to avoid early analysis by ad crawler scanners or sandbox environments.
Registry enumeration and dynamic defense checks to conditionally alter malware behavior if endpoint protection tools are present.
Legitimate-looking certificates to increase trust and reduce user suspicion.

These techniques combined make the malware harder to detect both at initial download and during staged payload execution.

6. Industry Impact and Telemetry Observations

According to Sophos telemetry gathered during the investigation:

Over 300 hosts were confirmed compromised across more than 100 customer environments prior to mitigation.
Affected sectors included technical operations, where users frequently sought PDFs and manuals — behavior the threat actor exploited to maximize distribution.

Sophos MDR and collaborating researchers from TrueSec, WithSecure, and G Data confirmed that the campaign remained active beyond initial detection, with evolving indicators and supporting infrastructure still functioning — highlighting that TamperedChef is not a one-off threat but an adaptive criminal operation.

7. Mitigation and Defensive Strategies

Defenders must adopt both preventive and detective controls to defend against similar campaigns.

7.1 Preventive Measures

Avoid installing software from ads: Users should only download tools from official vendor sites or verified repositories.
Implement application control policies: Allow only tightly vetted installers in enterprise environments.
Disable browser credential storage: Encourage password managers and enforce stronger MFA requirements.
Harden email gateways: Filter out malvertising links and educate users on recognizing deceptive ads.

7.2 Detective and Incident Response

Behavioral analytics: Look for registry autoruns and repeated scheduled task invocations from unusual binaries.
Endpoint detection: Employ EDR tools that detect malicious API calls (e.g., DPAPI harvesting, browser termination).
IOC tracking: Use threat intelligence feeds to track known C2 domains and hashes associated with the campaign.
Immediate remediation: Reimage compromised endpoints and reset credentials if a system was infected.

8. Conclusion

The TamperedChef campaign represents a heightened level of sophistication in malware distribution by blending malvertising, delayed execution, code-signing abuse, and stealthy infostealer deployment. By exploiting user trust in search ads and leveraging dormant malware tactics, threat actors have demonstrated how paid ad platforms can be weaponized for large-scale credential theft.

Continuous monitoring, threat hunting, and enhanced user education are essential to counter such evolving threats. Organizations must align defensive strategies with both technical controls (EDR, behavioral analytics) and policy enforcement (software sourcing, credential management) to reduce the attack surface and thwart similar campaigns in the future.