Back Blogs.Microsoft

Signed malware impersonating workplace apps deploys RMM backdoors

Blogs.Microsoft •Microsoft Defender Security Research Team • March 3, 2026

Signed malware backed by a stolen EV certificate deployed legitimate RMM tools to gain persistent access inside enterprise environments. Organizations must harden certificate controls and monitor RMM activity to reduce exposure.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Signed Malware Deploys RMM Backdoors via Phishing Campaigns Microsoft's Defender Security Research Team reported phishing campaigns utilizing signed malware disguised as workplace applications. This malware, backed by a stolen EV certificate, installs remote monitoring and management (RMM) tools to maintain persistent access within enterprise environments, posing a significant risk to organizations. Enhanced certificate controls and monitoring of RMM activity are recommended to mitigate exposure. 5 sources 64

Extracted Entities

Signed malware impersonating workplace apps deploys RMM backdoors

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (2)

Tools (1)