TamperedChef Malware Uses Signed Productivity Apps to Deliver Stealers and RATs

**Executive Summary:** TamperedChef (also called EvilAI) is a widespread, organized malware campaign that distributes credential-stealing infostealers and remote access Trojans by packaging malicious payloads inside seemingly legitimate productivity applications; operators abused valid code-signing certificates and ad-based distribution to infect large numbers of enterprise endpoints and used delayed, stealthy second-stage payloads to avoid detection.