New Electron-based malware campaign disguises itself as legitimate office tools to steal credentials

Security researchers uncover a sophisticated malware distribution effort leveraging popular PDF and productivity applications built on Electron, enabling covert data theft and persistent threats.

Security researchers have identified a new malware distribution effort that hides inside apparently useful PDF and productivity applications built on Electron, the cross-platform framework used for desktop software. According to G Data, the campaign relies on working user interfaces to reduce suspicion, while malicious code runs beneath the surface and can inject scripts or access desktop-capture functions through Electron APIs.

The German security company said it found a cluster of fake applications, including Kitchen Canvas, Food or Meal Formula and DocConvertWizard, each presented as a different utility but carrying the same underlying payload. The tactic mirrors earlier campaigns that used polished download sites and search-engine visibility to trick users into installing software they believed to be legitimate.

The technique is closely related to the TamperedChef operation, which security firms have linked to fraudulent PDF editors promoted through malvertising and SEO poisoning. Dataprise said that campaign initially behaves as advertised before activating an infostealer weeks later, giving attackers time to harvest credentials, browser cookies and other session data without immediate detection.

Sophos previously reported that TamperedChef was pushed through Google Ads and tied to the broader EvilAI operation, with victims identified in multiple countries, including the United Kingdom, Germany and France. TechRadar said the malware can remain dormant for roughly 56 days after installation, a delay that makes it harder for defenders to connect the infection to the original download.

The latest findings underline how ordinary office tools remain attractive delivery vehicles for threat actors. Cybersecurity researchers say the combination of a useful front end, signed or seemingly reputable installers, and trusted search placements makes these campaigns effective against users who are simply trying to manage PDFs or download a productivity utility. The practical risk is not only credential theft, but also the potential for follow-on access to corporate networks once a machine is compromised.