Cooking up trouble: How TamperedChef uses signed apps to deliver stealthy payloads

TamperedChef is a sophisticated global malvertising and SEO-driven campaign that delivers malicious payloads via seemingly legitimate, digitally signed installers. It leverages social engineering, malvertising, and abused code-signing certificates obtained through U. S. -registered shell companies to evade detection and increase user trust. The campaign primarily targets healthcare, construction, and manufacturing sectors, establishing persistence and deploying obfuscated JavaScript for remote access and control. Attackers may use this access for credential theft, ransomware preparation, or espionage. Although currently concentrated in the Americas, European organizations in similar sectors are at risk due to the campaign's stealth and persistence techniques. Mitigation requires enhanced scrutiny of signed applications, network monitoring for unusual JavaScript execution, and strict controls on software installation sources. Countries with significant healthcare and manufacturing industries, such as Germany, France, and the UK, are most likely to be affected. Given the medium severity rating and the complexity of exploitation, the threat is assessed as high severity for European contexts due to potential impact and stealth.

• RMM Tools Being Distributed Through Phishing Attacks (ScreenConnect, FleetDeck, Datto, SimpleHelp, JumpCloud, N-able)Malware2026-10-08
• Phishing Abuses RMM Tools for Persistent AccessMalware2026-09-29
• Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python PackagesHighVulnerability2026-10-26
• QuartzLine: A working PDF viewer with a backdoor insideMalware2026-10-16
• Fake Calendly "Meta Careers" pages steal Facebook and Google loginsCampaign2026-10-14