(paloaltonetworks.com) TamperedChef-Style Malware: The Stealthy Threat of Trojanized Productivity Applications
New analysis reveals TamperedChef-style malware campaigns leveraging trojanized productivity apps (PDF editors, calendars) via malvertising. Three clusters (CL-CRI-1089, CL-UNK-1090, CL-UNK-1110) identified since 2024, with 4K+ samples and 100+ variants delivering info-stealers/RATs after delayed activation.
In brief - TamperedChef malware uses legitimate-looking apps distributed via malicious ads to deploy stealthy payloads (info-stealers, RATs) after extended dormancy. Threat actors abuse code signing and vertical integration to evade detection, with global reach and no specific targeting.
Technically - Malware employs code-signing abuse, frequent binary rebuilding, and persistence via scheduled tasks/registry Run keys. Clusters CL-CRI-1089 (high TTP variability) and CL-UNK-1090 (vertical integration) demonstrate distinct operational traits. Payloads include adware, browser hijackers, and RATs, activated after weeks/months of dormancy. Tracking via certs/ad transparency reveals shell company networks.
Source: https://unit42.paloaltonetworks.com/tracking-tampered-chef-clusters/
#Cybersecurity #ThreatIntel
O RLY CYBER
npub1sh…0kwr0
2026-05-20 10:55:50 UTC
Author Public Key
npub1shlut8mwdmfevu2nt294apayu7e0mxs5mrpfyq8v5ru4ymscg9ysx0kwr0Seen on
wss://relay.momostr.pinkPublished at
2026-05-20 10:55:50 UTCEvent JSON
{
"id": "df6d3bd0efc2287d35e9c63bfdcf10fc1e016b22cd2bc5f0407a9fdc8b2d251a",
"pubkey": "85ffc59f6e6ed39671535a8b5e87a4e7b2fd9a14d8c29200eca0f9526e184149",
"created_at": 1779274550,
"kind": 1,
"tags": [
[
"proxy",
"https://swecyb.com/@orlysec/116606536912497818",
"web"
],
[
"t",
"threatintel"
],
[
"t",
"cybersecurity"
],
[
"proxy",
"https://swecyb.com/ap/users/116080658609901341/statuses/116606536912497818",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://swecyb.com/ap/users/116080658609901341/statuses/116606536912497818",
"pink.momostr"
],
[
"-"
]
],
"content": "(paloaltonetworks.com) TamperedChef-Style Malware: The Stealthy Threat of Trojanized Productivity Applications\n\nNew analysis reveals TamperedChef-style malware campaigns leveraging trojanized productivity apps (PDF editors, calendars) via malvertising. Three clusters (CL-CRI-1089, CL-UNK-1090, CL-UNK-1110) identified since 2024, with 4K+ samples and 100+ variants delivering info-stealers/RATs after delayed activation.\n\nIn brief - TamperedChef malware uses legitimate-looking apps distributed via malicious ads to deploy stealthy payloads (info-stealers, RATs) after extended dormancy. Threat actors abuse code signing and vertical integration to evade detection, with global reach and no specific targeting.\n\nTechnically - Malware employs code-signing abuse, frequent binary rebuilding, and persistence via scheduled tasks/registry Run keys. Clusters CL-CRI-1089 (high TTP variability) and CL-UNK-1090 (vertical integration) demonstrate distinct operational traits. Payloads include adware, browser hijackers, and RATs, activated after weeks/months of dormancy. Tracking via certs/ad transparency reveals shell company networks.\n\nSource: https://unit42.paloaltonetworks.com/tracking-tampered-chef-clusters/\n\n#Cybersecurity #ThreatIntel",
"sig": "2ad15a1314e836e71ec59499382ad3faf1a7a5737c97289c905707cc3b2bc35bb8e133a1a57d044690c27d8bfcc6c024a747d65e8c63d21cf8ff0832d1a638fd"
}