Malicious RVTools Installer Uses Sectigo Cert to Evade SmartScreen

Gbhackers •Mayura Kathir • May 29, 2026

A malicious fake RVTools installer is abusing a legitimately issued Sectigo code‑signing certificate to slip past Microsoft Defender SmartScreen and many endpoint controls, ultimately deploying a multi‑stage Python‑based RAT with deep AD reconnaissance and persistent C2 access. For VMware‑heavy environments, compromise of an administrator via this vector can effectively hand over domain‑level control to the […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Malicious RVTools Installer Exploits Sectigo Certificate to Evade Security Measures A counterfeit RVTools installer is utilizing a legitimate Sectigo code-signing certificate to bypass Microsoft Defender SmartScreen and other endpoint protections. This malicious software deploys a multi-stage Python-based remote access Trojan (RAT) capable of extensive Active Directory reconnaissance and maintaining persistent command-and-control (C2) access. The attack primarily targets VMware environments, posing a significant risk to IT administrators who rely on RVTools for managing virtual infrastructure. If an administrator is compromised, attackers could gain domain-level control over affected systems. The incident highlights the ongoing challenges of supply chain attacks and the misuse of trusted certificates in cyber threats. As of now, the situation is under investigation, and organizations are urged to remain vigilant. 2 sources 65

Extracted Entities

Malicious RVTools Installer Uses Sectigo Cert to Evade SmartScreen

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (1)

Platforms (2)

Tools (3)