TamperedChef Malware Uses Signed Productivity Apps to Deliver Stealers and RATs

Cybersecuritynews •Tushar Subhra Dutta • May 21, 2026

A new wave of malware disguised as everyday productivity tools has been quietly spreading across the internet, stealing user credentials and giving attackers remote control of infected systems. Researchers have tracked hundreds of campaigns tied to a threat known as TamperedChef, also called EvilAI, which wraps dangerous code inside apps that look and feel completely […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

TamperedChef Malware Campaign Targets Users via Signed Productivity Apps The TamperedChef malware campaign is exploiting trojanized productivity applications, including PDF editors and file converters, to deploy information stealers and remote access trojans (RATs). This large-scale threat has been linked to multiple activity clusters, with researchers tracking hundreds of campaigns. Users of these applications are at risk of credential theft and unauthorized remote access. The malware disguises itself within legitimate software, making detection challenging. Current threat intelligence suggests that this campaign is ongoing and evolving, with significant implications for user security. Organizations are urged to remain vigilant and monitor for unusual activity related to these applications. 2 sources 67

Extracted Entities

TamperedChef Malware Uses Signed Productivity Apps to Deliver Stealers and RATs

The full story

Extracted Entities

Attack Types (1)

Malware (2)

MITRE ATT&CK (1)