Record · corpus.blog/posts/01a0d4a2-34e6-73ae-8a47-696eb11f6c3e

Tracking TamperedChef Clusters via Certificate and Code Reuse

Unit 42 · published 20 May 2026

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at unit42.paloaltonetworks.com Wayback capture

0blogs citing

First cited: —
Most recent: —
Rank this month: not ranked
Links from this post: 19
Words captured: 6,085

Cited by

No blog we hold has cited this post yet.

Links from this post

Link

Host

https://docs-cortex.paloaltonetworks.com/p/XDR

docs-cortex.paloaltonetworks.com

https://docs-cortex.paloaltonetworks.com/p/XSIAM

docs-cortex.paloaltonetworks.com

https://docs.paloaltonetworks.com/prisma-access-browser

docs.paloaltonetworks.com

https://start.paloaltonetworks.com/contact-unit42.html

start.paloaltonetworks.com

https://www.acronis.com/en/tru/posts/cooking-up-trouble-how-tamperedchef-uses-signed-apps-to-deliver-stealthy-payloads/

acronis.com

https://neutralino.js.org/

neutralino.js.org

https://www.virustotal.com/gui/file/69934dc1d4fdb552037774ee7a75c20608c09680128c9840b508551dbcf463ad

virustotal.com

https://www.virustotal.com/gui/file/e32d6b2b38b11db56ae5bce0d5e5413578a62960aa3fab48553f048c4d5f91f0

virustotal.com

https://www.virustotal.com/gui/file/497ed5bca59fa6c01f80d55c5f528a40daff4e4afddfbe58dbd452c45d4866a3

virustotal.com

https://www.virustotal.com/gui/file/6cc87814eeade96bf19d2f9d816248e340834d74296346347268df83bce0b9aa

virustotal.com

https://www.sectigo.com/knowledge-base/detail/OV-Code-Signing-Validation-for-Organizations-and-Individuals

sectigo.com

https://www.semrush.com/blog/search-engine-marketing/?

semrush.com

https://docs.paloaltonetworks.com/advanced-url-filtering/administration/url-filtering-basics/url-categories

docs.paloaltonetworks.com

https://docs.paloaltonetworks.com/prisma-access-browser/administration/manage-prisma-access-browser-policy-profiles/configure-prisma-access-browser-data-controls/live-page-scanning

docs.paloaltonetworks.com

https://www.cyberthreatalliance.org

cyberthreatalliance.org

https://www.guidepointsecurity.com/blog/ai-exposes-homoglyph-hustle/

guidepointsecurity.com

https://www.trendmicro.com/en_us/research/25/i/evilai.html

trendmicro.com

https://www.truesec.com/hub/blog/tamperedchef-the-bad-pdf-editor

truesec.com

https://expel.com/blog/the-history-of-appsuite-the-certs-of-the-baoloader-developer/

expel.com