TamperedChef Malware Hides in Signed Apps to Drop Stealers and RATs

**Executive Summary:** TamperedChef is a global malvertising-driven campaign distributing trojanized productivity apps (PDF editors, calendar tools, file converters) that use legitimate-looking sites and code-signing certificates to evade detection, employ delayed activation and staged payloads (information stealers, RATs, proxies, adware), and have produced thousands of samples and estimated infections; the report maps clusters (e.g., CL-CRI-1089, CL-UNK-1090), lists many signer entities as IOCs, and recommends monitoring persistence, signed binaries from unknown publishers, and suspicious outbound connections.