Threat actors have discovered a new method to bypass security measures by abusing Microsoft’s Trusted Signing platform to sign malicious executables with legitimate certificates.

## The Value of Code-Signing Certificates

Code-signing certificates have long been prized by cybercriminals because they make malware appear legitimate and help bypass security filters. Extended Validation (EV) certificates, which require rigorous verification, have traditionally been the most valuable target as they gain automatic trust from security programs and improve reputation scores in Microsoft SmartScreen.

However, obtaining EV certificates is challenging and expensive, requiring either theft from legitimate companies or establishing fake businesses. Once used in malware campaigns, these certificates are typically revoked, rendering them useless for future attacks.

## Microsoft’s Trusted Signing Service Being Exploited

Cybersecurity researchers have identified a trend where attackers are now utilizing Microsoft’s Trusted Signing service to obtain short-lived, three-day code-signing certificates. These certificates, issued by “Microsoft ID Verified CS EOC CA 01,” are being used in active malware campaigns including Crazy Evil Traffers crypto-theft and Lumma Stealer operations.

The Microsoft Trusted Signing service, launched in 2024, offers cloud-based code signing for developers at $9.99 monthly. While designed with security features like short-lived certificates that can be easily revoked, the platform has become attractive to cybercriminals due to its accessibility.

## Why Attackers Are Switching

According to researcher ‘Squiblydoo’, who tracks certificate abuse, threat actors are likely switching to Microsoft’s service because:

– The verification process is substantially easier than for EV certificates
– Recent changes to EV certificates have created uncertainty
– Microsoft-signed certificates may provide adequate SmartScreen reputation benefits

## Microsoft’s Response

Microsoft has confirmed they use “active threat intelligence monitoring” to detect misuse of their signing service. When threats are identified, the company takes immediate action including certificate revocation and account suspension. Microsoft also noted that their antimalware products detect the malicious samples that have been identified.

While the certificates expire after three days, executables signed with them remain valid until Microsoft explicitly revokes the certificate, creating a window of opportunity for attackers to distribute their malware.