Do Son A fake RVTools installer campaign distributes a modular Python RAT. Learn how this malware uses signed certificates to evade security controls.
Code Signing Abuse
Rhysida ransomware is abusing Microsoft Trusted Signing to deploy OysterLoader (IAT) via Bing/Teams malvertising. The gang leveraged 40+ certificates to sign malware, bypassing security filters.