Back Gbhackers

Google Ads Exploited to Deliver TamperedChef Through Malicious PDF Editor

Gbhackers •Mayura Kathir • January 20, 2026

A sophisticated malvertising campaign tracked as TamperedChef has compromised over 100 organizations across 19 countries by distributing weaponized PDF editing software through Google Ads. Sophos Managed Detection and Response (MDR) teams discovered the operation in September 2025, revealing a multi-layered attack infrastructure designed to steal browser credentials and establish persistent backdoor access on Windows systems. […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Malvertising Campaign Distributes TamperedChef via Google Ads A malvertising campaign identified in September 2025 has targeted Windows users by promoting fake PDF editing applications through Google Ads. The malware, known as TamperedChef, has compromised over 100 organizations across 19 countries, stealing browser credentials and establishing backdoor access on infected systems. 3 sources 36

Extracted Entities

Google Ads Exploited to Deliver TamperedChef Through Malicious PDF Editor

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (1)

Platforms (1)