RATs

When a Signed App Isn’t Safe: How TamperedChef Slips Malware Past Your Defenses It’s common advice: only install software from official sources, and look for digital signatures to be sure it’s legitimate. But the TamperedChef malware campaign shows that even signed apps can be dangerous. Security researchers have found attackers using valid code signatures on popular productivity apps—like PDF editors and note-taking tools—to deliver info-stealers and remote access trojans (RATs) to unsuspecting users. ...

Malware Hidden in Signed Productivity Apps: How to Protect Yourself If you use apps like Microsoft Teams, Slack, or other productivity tools at work or home, a new malware campaign called TamperedChef should be on your radar. Security researchers have found that attackers are packaging malware inside legitimate-looking, signed versions of these apps. Because the apps carry valid digital signatures, they often slip past antivirus and other security checks. ...

Don’t Get Tricked by Fake Productivity Apps: What to Know About the TamperedChef Malware Campaign If you’ve ever downloaded a quick installer for Microsoft Teams, Zoom, or Slack from a third-party site, you’re not alone. Many people take shortcuts when they need a collaboration tool in a hurry. But that shortcut can lead straight into a malware trap. A recently uncovered campaign called TamperedChef is actively distributing information stealers and remote access trojans (RATs) through fake versions of popular productivity apps—and the worst part is that the malicious installers appear to be digitally signed, which makes them look legitimate. ...

New Malware ‘TamperedChef’ Hides in Signed Productivity Apps to Steal Your Data Introduction A new malware strain called TamperedChef is making the rounds, and it has a twist that makes it especially hard to spot: it’s delivered inside productivity applications that are digitally signed. That signature—usually a sign of authenticity—is being used to lull users and security software into a false sense of safety. Reports from cybersecurity news outlets indicate that attackers are repackaging or tampering with signed installers of apps like Microsoft Teams, Slack, and Zoom to inject information stealers and remote access trojans (RATs). ...

TamperedChef Malware: How Signed Productivity Apps Are Being Used to Spread Stealers and RATs Intro Recent reports describe a malware campaign called TamperedChef that delivers stealers and remote access trojans (RATs) by bundling them with seemingly legitimate productivity applications. What makes this campaign notable is that the malicious executables carry valid digital signatures—something that can trick both users and some security tools into assuming the software is safe. ...

TamperedChef Malware Spreads Through Fake Productivity Apps That Look Genuine A new malware campaign known as TamperedChef is tricking users by distributing fake productivity applications that carry valid digital signatures. Discovered in May 2026, the operation targets people searching for tools like Microsoft Teams, often via fake download pages or search engine ads. Once installed, these apps deliver remote access trojans (RATs) and information stealers, including ValleyRAT. ...

New Malware Hides Inside Legitimate-Looking Productivity Apps – Here’s How to Stay Safe A new campaign dubbed TamperedChef is making the rounds, using digitally signed productivity apps to drop credential stealers and remote access trojans (RATs) onto victims’ devices. What makes it difficult to spot is that these apps appear to be signed with legitimate certificates, which can trick both users and some automated security checks. Here’s what’s happening and how you can avoid being a target. ...

TamperedChef Malware: How Hackers Hide in Signed Productivity Apps – and How to Stay Safe Another wave of malware is making the rounds, and this one has a trick that makes it harder to spot. Security researchers have identified a campaign called TamperedChef that delivers dangerous software—info-stealers and remote access trojans (RATs)—by hiding inside productivity applications that appear to be legitimately signed. If you’ve ever downloaded a copy of Microsoft Teams, Zoom, or Slack from anywhere other than the official source, this is worth a close look. ...

How to Stay Safe from TamperedChef Malware Hiding in Productivity Apps If you’ve ever downloaded an installer for Microsoft Teams, Slack, or Zoom from a third-party site, you may have bypassed the official source and gotten something else. A recent malware campaign called TamperedChef is doing exactly that: it uses signed installers of common productivity apps to sneak past security checks and deliver information stealers and remote access trojans (RATs). According to cybersecurity news reports from late May 2026, the campaign is active and targets remote workers and small business owners who rely on these tools. ...

Malware That Hides in Signed Apps: How to Protect Yourself from TamperedChef If you download productivity software like Microsoft Teams, Office tools, or collaboration apps, you probably assume that if the file has a valid digital signature, it’s safe. A newly documented campaign called TamperedChef shows why that assumption can be dangerous. Attackers are using signed, but malicious, versions of popular apps to deliver information stealers and remote access trojans (RATs). Here’s what’s happening and what you can do about it. ...