Signed malware impersonating workplace apps deploys RMM backdoors

Multiple phishing campaigns were identified using workplace meeting lures, PDF attachments, and abuse of legitimate binaries to deliver signed malware. The attacks used digitally signed executables masquerading as legitimate software to install remote monitoring and management (RMM) tools like ScreenConnect, Tactical RMM, and Mesh Agent. These tools enabled attackers to establish persistence and move laterally within compromised environments. The malware was signed using an Extended Validation certificate issued to TrustConnect Software PTY LTD. The campaigns demonstrate how familiar branding and trusted digital signatures can be exploited to bypass user suspicion and gain an initial foothold in enterprise networks.

• Managed for Malice: How Attackers Turn MDM into Remote AccessCampaign2026-10-28
• Fake "View & Sign" and Adobe Acrobat Lures Deliver Attacker-Configured ScreenConnect ClientsMalware2026-10-29
• How VBScript Malware Evades Detection Using Trusted Tools CopyMalware2026-10-27
• Tricks from the Past deployed via signed ChatGPT and Claude binariesMalware2026-10-27
• Microsoft Teams to get AI-powered, context-aware phishing detectionNews2026-10-23