TamperedChef Malware Hides in Signed Apps to Drop Stealers and RATs

Gbhackers •Mayura Kathir • May 21, 2026

A large-scale malware campaign dubbed “TamperedChef” is leveraging trojanized productivity applications such as PDF editors, calendar tools, and file converters to silently deploy information stealers and remote access trojans (RATs), according to recent threat intelligence findings. Security researchers have identified multiple activity clusters linked to this evolving threat, including CL-CRI-1089, CL-UNK-1090, and CL-UNK-1110. While these […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

TamperedChef Malware Campaign Targets Users via Signed Productivity Apps The TamperedChef malware campaign is exploiting trojanized productivity applications, including PDF editors and file converters, to deploy information stealers and remote access trojans (RATs). This large-scale threat has been linked to multiple activity clusters, with researchers tracking hundreds of campaigns. Users of these applications are at risk of credential theft and unauthorized remote access. The malware disguises itself within legitimate software, making detection challenging. Current threat intelligence suggests that this campaign is ongoing and evolving, with significant implications for user security. Organizations are urged to remain vigilant and monitor for unusual activity related to these applications. 2 sources 67

TamperedChef Malware Hides in Signed Apps to Drop Stealers and RATs

The full story

Extracted Entities

Attack Types (2)

Malware (1)