TamperedChef: Global Malvertising Campaign Uncovered

Acronis’ Threat Research Unit has exposed a global malvertising campaign, TamperedChef, distributing trojanized applications through malvertising and SEO-poisoning. These fake applications, signed with certificates from shell companies, deploy scheduled tasks and JavaScript backdoors for remote access and long-term control. The campaign targets multiple industries, including healthcare, construction, and manufacturing, with a significant number of victims in the Americas. The threat actors operate with a highly organized infrastructure, using a network of shell companies to acquire and rotate code-signing certificates.