Recently, cybersecurity researchers have seen threat actors utilizing the Microsoft Trusted Signing service to sign their malware with short-lived, three-day code-signing certificates. A cybersecurity researcher and developer known as 'Squiblydoo,' who has been tracking malware campaigns abusing certificates for years, told BleepingComputer that they believe threat actors are switching to Microsoft's service out of convenience. Microsoft also says certificates issued through the Trusted Signing service provide a similar SmartScreen reputation boost to executables signed by its service. Cybercriminals are abusing Microsoft's Trusted Signing platform to code-sign malware executables with short-lived three-day certificates. BleepingComputer contacted Microsoft about the abuse and was told that the company uses threat intelligence monitoring to find and revoke certificates as they are found. "We use active threat intelligence monitoring to constantly look for any misuse or abuse of our signing service," Microsoft told BleepingComputer. "Trusted Signing is a complete code signing service with an intuitive experience for developers and IT professionals, backed by a Microsoft managed certification authority," reads a Microsoft announcement for the service. The Microsoft Trusted Signing service launched in 2024 and is a cloud-based service that allows developers to easily have their programs signed by Microsoft. The holy grail for threat actors is to obtain Extended Validation (EV) code-signing certificates, as they automatically gain increased trust from many cybersecurity programs due to the more rigorous verification process. To protect against abuse, Microsoft is currently only allowing certificates to be issued under a company name if they have been in business for three years. For a long time, using EV certificates has been the standard, but Microsoft has announced changes to EV certificates," Squiblydoo told BleepingComputer. Threat actors have long sought after code-signing certificates as they can be used to sign malware to appear like they are from a legitimate company.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Sat, 22 Mar 2025 14:30:15 +0000