In recent weeks, security teams have observed a surge in malvertising campaigns distributing what appears to be a fully functional PDF editor.

Dubbed TamperedChef, this malware masquerades as a legitimate application—AppSuite PDF Editor—leveraging convincing advertisements to lure European organizations and individuals into downloading the installer.

Once executed, the installer exhibits expected functionalities for nearly two months, during which victims remain unaware of its true nature.

During installation, users encounter a professional end-user license agreement dialogue consistent with mainstream software offerings.

This dialog, displayed in multiple languages, reinforces the illusion of legitimacy and bypasses automated sandbox detonations.

Clicking Accept and Install allows the MSI package to proceed without requiring administrative privileges, making it particularly effective in corporate environments with restricted user rights.

WithSecure Labs analysts identified TamperedChef following a sudden spike in credential-theft incidents within enterprise environments.

Telemetry data revealed that, upon activation, the malware’s hidden payload initiates the systematic harvesting of browser-stored usernames and passwords.

This exfiltration occurs silently, with stolen credentials transmitted to attacker-controlled infrastructure, paving the way for backdoor access and further lateral movement.

Once the malicious payload embedded within pdfeditor.js activates, the application transitions from a benign editor to a stealthy credential harvester.

The attack is orchestrated using a custom NodeJS module—Utilityaddon.node—which interacts with native Windows APIs to manipulate registry entries and scheduled tasks for persistence.

By inserting autorun registry keys under the current user hive, the malware ensures execution at each logon without elevating privileges.

Infection Mechanism

The infection begins when a user clicks a malicious advertisement and downloads the AppSuite PDF Editor installer from vault.appsuites.ai.

This installer, created with the Nullsoft Scriptable Install System (NSIS), unpacks the Electron-based application under the user’s profile directory.

The primary executable, PDF Editor.exe, launches a Chromium-based interface that loads additional JavaScript modules from remote servers.

Before any PDF editing functionality is available, the installer sets persistence via an autorun registry entry named PDFEditorAutoUp that points to the installed application.

At runtime, the obfuscated pdfeditor.js script checks for command-line switches, notably --cm, which triggers malicious routines:-

if (app.commandLine.hasSwitch('cm')) {
  utilityAddon.setupTasks(globals.scheduledTaskName);
  startCredentialHarvest();
}

By using command-line flags, the threat actors can toggle between benign and malicious behaviors, complicating detection.

Once the script executes startCredentialHarvest(), it scans local browser storage for credentials and dispatches them over HTTPS to attacker-controlled endpoints, while the visible PDF editor interface remains functional to avoid arousing suspicion.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post TamperedChef Malware as PDF Editor Harvest Browser Credentials and Allows Backdoor Access appeared first on Cyber Security News.

Yurei ransomware first emerged in early September 2025, targeting Windows environments with a sophisticated Go-based payload designed for rapid, large-scale encryption.

Once executed, the malware enumerates all accessible local and network drives, appends a .Yurei extension to each file, and writes unique ransom notes in every affected directory.

Its operators then demand payment over Tor, warning that shadow copies, backups, and log files have been irreversibly destroyed to frustrate recovery efforts.

Distributed primarily through stolen credentials and spear-phishing campaigns, Yurei exploits Windows Management Instrumentation (WMI) and credential-based remote execution to gain a foothold in corporate networks.

After initial compromise, the binary stages itself in temporary folders and deploys PowerShell scripts that disable Volume Shadow Copy Service (VSS) and delete all existing backups.

Cyfirma analysts noted that the ransomware’s combination of per-file ChaCha20 encryption keys wrapped with ECIES and its self-cleaning routines make forensic investigation exceedingly difficult.

Upon deployment, Yurei enters an infinite propagation loop, copying itself onto USB devices as WindowsUpdate.exe and into writable SMB shares as System32Backup.exe.

This dual propagation strategy allows the malware to leapfrog network segmentation controls and spread laterally with minimal detection.

Victims report that encrypted files become entirely inaccessible, since each ChaCha20 key and nonce pair is asymmetrically wrapped with the attackers’ embedded public key and stored in a custom header separated by the ASCII marker 0x7c7c.

Infection Mechanism and Lateral Propagation

The core of Yurei’s infection mechanism relies on PowerShell and native Windows utilities to propagate across removable and network drives.

First, it queries all volumes of type “removable” via WMI and checks for an existing WindowsUpdate.exe at each root.

If absent, it copies the ransomware executable from its temp staging directory. Next, it enumerates SMB shares via PowerShell’s Get-SmbShare cmdlet and iterates over each writable share path, using Copy-Item to drop System32Backup.exe.

A snippet illustrating the removable‐media propagation routine is shown below.

# Figure 1: Removable drive propagation using PowerShell
$drives = Get-WmiObject -Class Win32_Volume | Where-Object {$_.DriveType -eq 2}
foreach ($drive in $drives) {
    $path = "$($drive.DriveLetter)\WindowsUpdate.exe"
    if (-not (Test-Path $path)) {
        Copy-Item -Path $MyInvocation.MyCommand.Definition -Destination $path -Force
    }
}

Once copied, Yurei spawns each dropped instance remotely via a PSCredential-based CIM session or PsExec-style invocation, ensuring the payload executes under elevated privileges without user interaction.

The script constructs a System.Management.Automation.PSCredential object and invokes Invoke-CimMethod to create a process on remote hosts, copying its own binary bytes to disk before execution.

By combining these stealthy propagation loops with aggressive anti-forensics—deleting VSS snapshots (vssadmin Delete Shadows /Quiet), clearing event logs, and overwriting its binary in memory—Yurei represents a highly automated, self-propagating threat designed for maximum network penetration and irreversible data compromise.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Yurei Ransomware Leverages SMB Shares and Removable Drives to Encrypt Files appeared first on Cyber Security News.