Your trust, our signature

This blogpost demonstrates how attackers (or red teams) can obtain and use legitimate S/MIME email certificates and lookalike domains to send signed phishing emails that appear trustworthy in common mail clients, includes a Python signing example and operational notes, and recommends mitigations such as registering similar domains, restricting the Secure Email EKU, and user awareness training.