How to Spot TamperedChef Malware: Fake Signed Apps Are Spreading Stealers and RATs

You download a note‑taking app that appears to come from a well‑known developer. The file is digitally signed, so Windows or macOS doesn’t show any security warnings. You install it, and a few days later your email account is compromised and your browser passwords are stolen. This is the kind of scenario the TamperedChef malware is designed to create.

TamperedChef is a recently documented malware campaign that uses legitimate‑looking, digitally signed productivity applications to deliver information stealers and remote access trojans (RATs). The malware has been spreading through unofficial download sites and peer‑to‑peer networks, often disguised as PDF editors, note‑taking tools, or other software many people need for work or school.

What happened

According to reporting from CyberSecurityNews, researchers have identified TamperedChef as a campaign that abuses code‑signing certificates to make malicious apps appear trustworthy. Instead of breaking into official app stores, the attackers obtain or forge digital signatures—sometimes by stealing them from legitimate developers—then package malware into installer files. When a user runs the installer, the signature check passes and the operating system treats the file as safe.

The payloads in TamperedChef include stealers that harvest passwords, browser cookies, and cryptocurrency wallet data, as well as RATs that give attackers remote control over the infected machine. The malware specifically targets productivity apps because they have a broad user base and are often downloaded from third‑party sites rather than official stores.

Why it matters

Many consumers assume that if a file is digitally signed, it must be safe. That assumption is dangerous. A valid signature only confirms that the file hasn’t been tampered with since it was signed—it does not guarantee that the software is benign. When attackers compromise a signing certificate, they can sign their malware just as easily as the original developer signs their updates.

TamperedChef is not the first campaign to abuse signed apps, but it highlights a growing trend: cybercriminals are moving beyond simple unsigned executables and are investing in stolen or forged certificates to bypass defenses. For everyday users, this means that visible security warnings are no longer a reliable indicator of risk. Even a file that passes signature verification can still be malicious.

What you can do to protect yourself

There is no single tool that will catch every signed malware sample, but you can reduce your risk with a few practical steps.

1. Always download from official sources. The simplest and most effective protection is to only install software from the developer’s official website or from trusted app stores (Microsoft Store, Mac App Store, Google Play, etc.). TamperedChef relies on users searching for “free download” of a tool and landing on third‑party sites that host the infected installer.

2. Verify the publisher name before installing. When Windows or macOS shows a publisher name during installation, check that it matches the actual developer. For example, a PDF editor from Adobe should show “Adobe Inc.”, not a random name. If the publisher is unfamiliar or doesn’t match the app you think you’re installing, cancel the installation. You can also right‑click the installer file, go to Properties (Windows) or Get Info (macOS), and look at the digital signatures tab to see the certificate details.

3. Scrutinize app permissions. During installation or at first launch, pay attention to what the app asks for. A simple note‑taking app requesting access to your camera, microphone, or full disk access is a red flag. If the permissions seem excessive for the task, uninstall the app immediately.

4. Keep your operating system and security software updated. Both Windows Defender and macOS XProtect receive frequent updates that can detect newly signed malware. Enable automatic updates to stay protected as new threat signatures are added.

5. Use a reputable malware scanner. If you have already downloaded a suspicious file, you can upload it to a service like VirusTotal before running it. VirusTotal checks the file against dozens of antivirus engines. However, a single clean result doesn’t guarantee safety—some signed malware still evades detection.

What to do if you suspect an infection

If you think you’ve installed a TamperedChef‑infected app:

  • Disconnect from the internet immediately to prevent data exfiltration.
  • Run a full scan with Windows Defender or another reputable antivirus.
  • Change passwords for all accounts that were accessed from the infected device, using a different device if possible.
  • Enable two‑factor authentication on critical accounts.
  • Consider a full system restore or reinstall if the scan does not remove the infection.

Sources

  • CyberSecurityNews, “TamperedChef Malware Uses Signed Productivity Apps to Deliver Stealers and RATs”, May 21, 2026.
  • The Hacker News, “ThreatsDay Bulletin”, May 21, 2026 (context on ongoing threat campaigns).