Malicious RVTools Installer Uses Sectigo Cert to Evade SmartScreen

A malicious fake RVTools installer is abusing a legitimately issued Sectigo code‑signing certificate to slip past Microsoft Defender SmartScreen and many endpoint controls, ultimately deploying a multi‑stage Python‑based RAT with deep AD reconnaissance and persistent C2 access. For VMware‑heavy environments, compromise of an administrator via this vector can effectively hand over domain‑level control to the […]

The post .