Beware of fake productivity apps: new malware uses signed files to avoid detection

You’re running low on disk space and looking for a lightweight note-taking app. A quick search turns up a clean-looking download page with a familiar logo and a direct download link. The file is digitally signed—your computer doesn’t complain. That green checkmark used to mean something. Lately, it’s less reliable.

A campaign tracked as TamperedChef is using signed productivity applications to distribute information stealers and remote access trojans (RATs). The malware is designed to look trustworthy, making it harder for casual users to spot the danger.

What happened

In May 2026, security researchers at CyberSecurityNews reported that TamperedChef operators were packaging malware with legitimate-looking digital signatures. The signatures are either stolen or abused—meaning the executable carries a cert that appears valid, even though the software itself is malicious.

The malware arrives through phishing emails and fake download portals. The attackers mimic popular productivity apps: document editors, project management tools, and note-taking software. If someone searches for “lightweight PDF editor free download” or “team planner app for Windows,” they may land on a site that looks official but isn’t.

Once run, the installer drops a stealer that harvests credentials, browser cookies, and files. Some variants also install a RAT, giving attackers remote control of the machine.

Why signed apps are dangerous

Digital signatures have long been used as a shorthand for “safe.” If a file shows a valid signer, operating systems like Windows are less likely to block it, and users feel reassured. That trust is being exploited.

Attackers can obtain code signing certificates through:

  • Stolen private keys from legitimate developers
  • Purchasing certificates from shady resellers
  • Compromising developer accounts to get certificates issued in their name

A signed file tells you who published it, but not whether the publisher is honest. A stolen certificate from a known company makes the malware almost indistinguishable from the real thing.

What readers can do

1. Stick to official sources

Download software from the developer’s official website or a trusted app store (Microsoft Store, Mac App Store, or verified package managers). Third-party download sites are where TamperedChef often lurks. Even if a site looks professional, check the URL carefully—misspellings like “microsft.com” are a giveaway.

2. Verify the signature yourself

Right-click the installer > Properties > Digital Signatures. Look at the signer name. Does it match the software’s developer? If it says “John Smith” for an app from a major company, that’s suspicious. Also check the timestamp date. A certificate issued three days ago for an app that’s been around for years is a red flag.

3. Use security software that scans signed files

Many antivirus tools treat signed executables with lower suspicion. TamperedChef can bypass some traditional scanners. Look for security software that performs behavioral analysis or sandbox execution. Free tools like Malwarebytes or Microsoft Defender (with real-time protection on) can help, but no scanner is perfect.

4. Beware of urgent download prompts

TamperedChef often uses fake “update now” banners or “your app is out of date” warnings in phishing emails. If a message pressures you to download an attachment or click a link, pause. Visit the official site directly to check for updates.

What to do if you think you’ve installed it

  • Disconnect from the internet immediately.
  • Run a full system scan with your antivirus.
  • If possible, boot into safe mode with networking and use a tool like Malwarebytes to scan.
  • Change passwords for all accounts you accessed on that device.
  • Enable two-factor authentication on sensitive accounts.

If you’re not comfortable cleaning the machine yourself, consider restoring from a known-good backup or taking the device to a repair shop.

The bigger picture

TamperedChef is one example of a broader trend: attackers are investing in making malware look legitimate. Code signing abuse is on the rise, and operating systems are slowly improving how they handle certificate trust, but it’s an arms race.

For now, the most effective defense is a healthy skepticism about anything you download. The green checkmark is a starting point for inspection, not a finish line.

Sources