Malicious Code-signing at Scale: How Attackers Impersonate Thousands of Real Businesses
summary
Research-backed dataset shows ~2.5k abused code‑signing certificates tracked and about 70 new malicious certs per month, mostly obtained by impersonation and resale for $2k–$7k. Attackers sign loaders and RATs (Quakbot, SolarMarker, NetSupport, Luma, UNC50, Oyster, ScreenConnect, Castle Loader) and sometimes use CA compromise (DigiCert) to intercept legit certs. Defenders use the cert graveyard and cert report to force revocation, pivot detections via VirusTotal/Malware Bazaar, and block hashes with WDAC.
AI-written summary · about
chapters (10)
- 0:00Code-signing abuse introduction
- 3:14How code signing builds trust
- 5:39Scale of malicious certificates
- 9:10Black Basta’s certificate tactics
- 13:07Malicious compliance via reselling
- 16:45Impersonation and shell companies
- 18:27Database manipulation risks
- 21:55Defender actions against abuse
- 26:29Recap and key takeaways
- 26:49Q&A
related talks
30mDeception at Scale: How Malware Abuses Trust
55mGovernments As Malware Authors: The Next Generation
28mHow to Use Code Signing to Protect your Critical Software
31mWatching Commodity Malware Get Sold to a Targeted Actor
46mBatloader or FakeBat? Unraveling Competing MaaS Operations
40mThe Canary in the Coalmine of Cybersecurity: Fraud as a Warning Sign
52mFlying Under the Radar - New Security Evasion Techniques
49mThe State Of Malware From The Eye Of The Tiger