TamperedChef Malware: How to Spot Fake Signed Apps Before They Steal Your Data

A new campaign uses stolen code-signing certificates to make malware look legitimate. Here’s what you need to know – and how to protect yourself.

What happened

In May 2026, researchers reported a malware campaign dubbed TamperedChef that delivers information stealers and remote access trojans (RATs) through digitally signed productivity applications. Attackers obtained valid code-signing certificates – either stolen or fraudulently issued – and used them to sign malicious installers. Because many operating systems and antivirus tools treat signed software as trustworthy, the malware can bypass initial checks and infect systems without raising immediate alarms.

The specific apps targeted have not been publicly confirmed to avoid tipping off attackers, but the campaign focuses on popular productivity tools such as note‑taking and project management software.

Why it matters

A digital signature is not a guarantee of safety. It only confirms that the file was signed with a particular certificate, not that the publisher is legitimate. Attackers have been abusing this trust for years, and TamperedChef is a reminder that even signed software can be dangerous. For everyday users who rely on the little “verified publisher” badge, this campaign is a wake‑up call to look deeper.

If you install TamperedChef‑infected software, the malware can steal passwords, capture keystrokes, or give attackers remote control of your computer. Because the apps appear normal during installation, many people don’t realize something is wrong until their accounts are compromised or sensitive data is exfiltrated.

What readers can do

The good news is that you don’t need to become a security expert to defend against this threat. A few simple habits can dramatically reduce your risk.

1. Always download from the official source

Only install productivity apps from the developer’s own website or from a trusted app store (Microsoft Store, Mac App Store, or reputable package managers). Avoid third‑party download sites, even if they seem convenient. If an app appears through a pop‑up ad or a link in an email, double‑check the URL.

2. Verify the digital signature yourself

On Windows:

  • Right‑click the installer file and select Properties.
  • Go to the Digital Signatures tab.
  • Look at the name of the signer. Does it match the developer you expected? For example, if you download a note‑taking app from “Acme Corp,” the signer should be “Acme Corp,” not a random name.
  • Check the date and time of signing. A brand‑new certificate on an app that has been around for years could be suspicious.

On macOS:

  • Open Terminal and run:
    codesign -dv /path/to/file.app
  • Look for Authority lines. They should show a chain that ends with a trusted root certificate. Also note the TeamIdentifier – mismatched or missing identifiers are red flags.

3. Watch for unusual behavior

After installation, pay attention to how the app behaves. Does it ask for unexpected permissions (e.g., access to your camera, microphone, or system files)? Does it run slowly or trigger security alerts? Legitimate productivity apps rarely request broad system‑level access. If something feels off, uninstall it immediately and run a full system scan.

4. Use security tools that check reputation

Modern antivirus and anti‑malware programs look beyond signatures. They check file reputation, behavior analysis, and cloud intelligence. Tools like Windows Defender (enabled by default) or third‑party scanners can catch signed malware if they detect anomalous payloads. Make sure your antivirus is up to date and active.

5. Know what to do if you suspect an infection

If you think you’ve installed a malicious signed app:

  • Disconnect from the internet immediately.
  • Run a full antivirus scan from a trusted bootable recovery environment if possible.
  • Change passwords for your accounts, especially email and banking, using a clean device (another computer or your phone).
  • Monitor your accounts for unauthorized activity.
  • Consider restoring your system from a known‑good backup that predates the infection.

The limitations of this advice

No single check is foolproof. Attackers can forge signatures that pass basic verification, and some legitimate apps may appear suspicious due to poor signing practices. When in doubt, research the app online using the official developer’s website, not a search engine result from an ad. If you can’t find clear endorsements, err on the side of caution.

TamperedChef is one of several ongoing campaigns that exploit trust in digital signatures. Staying informed and maintaining cautious habits is your best defense.

Sources

  • CyberSecurityNews, “TamperedChef Malware Uses Signed Productivity Apps to Deliver Stealers and RATs,” May 21, 2026.
  • The Hacker News, “ThreatsDay Bulletin,” May 21, 2026.
  • General knowledge of code‑signing abuse (publicly documented by Microsoft, Apple, and security firms).