My current tech support patient has a bad case of TamperedChef.
It came in through a trojanized PDFEditor download.
My customer was tricked into downloading the trojan because it spreads through Google malvertising. The malicious ads appeared first, second, and third, and Google's ads are indistinguishable from organic search results.
The ads weren't blocked because my customer uses Google Chrome.
The installation wasn't blocked because my customer had an active McAfee subscription.
If you need yet another reason to quit Google Chrome and quit Google Search, there you go.