TamperedChef Malware Campaign Targets Users via Signed Productivity Apps

Severity: High (Score: 66.5)

Sources: Cybersecuritynews, Gbhackers

Published: 2026-05-21 · Updated: 2026-05-21

Keywords: malware, tamperedchef, productivity, stealers, signed, apps, rats

Severity indicators: malware, stealer, rat

Summary

The TamperedChef malware campaign is exploiting trojanized productivity applications, including PDF editors and file converters, to deploy information stealers and remote access trojans (RATs). This large-scale threat has been linked to multiple activity clusters, with researchers tracking hundreds of campaigns. Users of these applications are at risk of credential theft and unauthorized remote access. The malware disguises itself within legitimate software, making detection challenging. Current threat intelligence suggests that this campaign is ongoing and evolving, with significant implications for user security. Organizations are urged to remain vigilant and monitor for unusual activity related to these applications. Key Points: • TamperedChef malware uses signed productivity apps to deploy stealers and RATs. • Hundreds of campaigns have been linked to this evolving threat, affecting numerous users. • Detection of TamperedChef is challenging due to its disguise within legitimate software.

Detailed Analysis

**Impact** Users of productivity applications such as PDF editors, calendar tools, and file converters are targeted by the TamperedChef malware campaign. The campaign affects a large number of victims globally, with hundreds of related campaigns identified. The malware steals user credentials and enables remote control of infected systems, risking sensitive business and personal data. Specific sectors and geographic details are not provided in the available sources. **Technical Details** The attack vector involves trojanized, digitally signed productivity applications that appear legitimate to users. The malware delivers information stealers and remote access trojans (RATs) during the installation or use of these apps. Multiple activity clusters associated with this threat include CL-CRI-1089, CL-UNK-1090, and CL-UNK-1110. No CVEs or specific infrastructure details are mentioned in the articles. **Recommended Response** Defenders should prioritize blocking known indicators of compromise related to the identified activity clusters and monitor for unusual behavior in productivity applications, especially those digitally signed but obtained from unofficial sources. Deploy detections for information stealer and RAT behaviors and enforce strict application whitelisting policies. No specific patches or CVEs are cited; therefore, monitoring and restricting the use of unverified signed apps is critical.

Source articles (2)

• TamperedChef Malware Uses Signed Productivity Apps to Deliver Stealers and RATs — Cybersecuritynews · 2026-05-21
  A new wave of malware disguised as everyday productivity tools has been quietly spreading across the internet, stealing user credentials and giving attackers remote control of infected systems. Resear…
• TamperedChef Malware Hides in Signed Apps to Drop Stealers and RATs — Gbhackers · 2026-05-21
  A large-scale malware campaign dubbed “TamperedChef” is leveraging trojanized productivity applications such as PDF editors, calendar tools, and file converters to silently deploy information stealers…

Timeline

• Recent — TamperedChef malware identified: Researchers reported a large-scale malware campaign using trojanized productivity apps to deploy malicious payloads.
• Recent — Multiple activity clusters linked: Security researchers identified activity clusters CL-CRI-1089, CL-UNK-1090, and CL-UNK-1110 associated with TamperedChef.
• Recent — Credential theft reported: The malware campaign is stealing user credentials and providing remote access to attackers.

Related entities

• Malware (Attack Type)
• Trojan (Attack Type)
• EvilAI (Malware)
• TamperedChef (Malware)
• T1036 - Masquerading (Mitre Attack)