1. A computer-implemented method for classifying package files as Trojans, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising: detecting a resemblance between an unclassified package file and a known legitimate package file; determining that the unclassified package file is signed by a different signatory than a signatory that signed the known legitimate package file; determining that a feature of the unclassified package file is suspicious, the feature being absent from the known legitimate package file; classifying the unclassified package file as a Trojan version of the known legitimate package file based on the unclassified package file being signed by the different signatory and having the suspicious feature.