When Even Signed Apps Aren’t Safe: The TamperedChef Malware Campaign

You’ve probably heard the standard advice: only install software that’s digitally signed. A valid signature is supposed to mean the program comes from a legitimate developer and hasn’t been modified. But a new malware campaign called TamperedChef is exploiting that assumption. According to a report from CyberSecurityNews (May 21, 2026), attackers are distributing malicious versions of common productivity apps—like notepads and calculators—that carry valid digital signatures. Once installed, they deliver stealers and remote access trojans (RATs) that can grab passwords, financial data, and even take over your computer.

This isn’t a theoretical risk. The campaign is active, and the malware is designed to bypass many standard defenses because the signature checks out.

What Happened

Security researchers discovered that the TamperedChef operators are taking legitimate productivity apps, bundling them with malware, and then signing the resulting package—possibly using stolen or misused code-signing certificates. The signed apps look authentic to both operating systems and antivirus engines that trust signed software.

The payloads include:

  • Info-stealers that harvest saved passwords, browser cookies, and cryptocurrency wallets.
  • RATs (remote access trojans) that let attackers view your screen, log keystrokes, and install further malware.

The exact list of targeted apps isn’t public yet, but the campaign appears to focus on lightweight utilities that many people download from third-party sites rather than official app stores.

Why It Matters

Most users—and many security tools—treat a digital signature as a mark of safety. The whole point of code signing is to prove integrity and origin. TamperedChef breaks that trust. If you see a signed “Notepad Plus” or “Simple Calculator” from an unknown website, you might assume it’s fine. With this campaign, that assumption can lead directly to infection.

The real-world impact is serious. Once a stealer or RAT is on your machine, your personal data is at immediate risk. Attackers can access online accounts, initiate fraudulent transactions, or use your computer as part of a botnet.

What You Can Do

The good news is that a few practical habits can keep you safe, even when attackers are using signed apps.

1. Only download from official sources

Stick to well-known app stores (Microsoft Store, Apple’s Mac App Store, or the developer’s official website). Avoid third-party download portals. If an app isn’t available from a store, verify the publisher’s identity before downloading.

2. Check the digital signature—but with caution

On Windows, right-click the installer, go to Properties → Digital Signatures, and see who signed it. Look up the publisher. Is it a known company? Does the certificate info match the app’s name? Be suspicious if a calculator is signed by a name you’ve never heard of or one that seems generic.

3. Keep your OS and security software updated

Antivirus vendors will likely add signatures for TamperedChef. Enable automatic updates so you get those protections quickly. Also, install operating system updates that patch vulnerabilities the malware could exploit.

4. Watch for unusual permissions

During installation, pay attention to what the app requests. A calculator that asks for internet access or permission to read your files is a red flag. Decline anything that doesn’t make sense for the app’s function.

5. Monitor for infection signs

If you suspect you’ve installed something suspicious, look for:

  • Unexplained slowdowns or crashes
  • New toolbars or browser extensions you didn’t add
  • Unexpected pop-ups
  • Unauthorized account activity (emails sent from your account, purchases you didn’t make)

6. Use a reputable security suite

A good antivirus can detect known malware even if it’s signed. Some suites also include behavior-based detection that flags apps trying to access sensitive data without a clear reason.

Signs You May Already Be Compromised

If you downloaded a productivity app from an unfamiliar site in the past few weeks, check for these symptoms:

  • Your password manager keeps asking to re-enter credentials.
  • You find new browser extensions or changed settings.
  • Your computer often shows high disk or CPU usage when idle.
  • Friends or colleagues report receiving strange links or messages from you.

If any of these appear, run a full scan with your security software, reset your passwords, and consider enabling two-factor authentication on important accounts.

The Bottom Line

TamperedChef is a reminder that digital signatures alone aren’t enough to guarantee safety. The campaign is active, and it specifically targets the kind of small, useful apps many of us grab without a second thought. Stay cautious, stick to official sources, and don’t let a blue verified badge lull you into skipping the other security steps.

Sources:

  • CyberSecurityNews, “TamperedChef Malware Uses Signed Productivity Apps to Deliver Stealers and RATs,” May 21, 2026.