Microsoft Trusted Signing service abused to code-sign malware

Cybercriminals have been observed abusing Microsoft’s Trusted Signing service to obtain short-lived (three-day) code-signing certificates and sign malware samples, enabling them to evade security warnings and improve file reputation; multiple active campaigns (including crypto-theft and info-stealer activity) have been linked to these signed binaries, and Microsoft reports active monitoring, certificate revocation, and account suspension to mitigate the abuse.