Signed Malware Deploys RMM Backdoors via Phishing Campaigns

Microsoft's Defender Security Research Team reported phishing campaigns utilizing signed malware disguised as workplace applications. This malware, backed by a stolen EV certificate, installs remote monitoring and management (RMM) tools to maintain persistent access within enterprise environments, posing a significant risk to organizations. Enhanced certificate controls and monitoring of RMM activity are recommended to mitigate exposure.