Signed malware impersonating workplace apps deploys RMM backdoors

Microsoft Security Blog posts (Feb–Mar 2026) describe multiple active and emerging enterprise threats and defensive guidance: signed malware using a stolen EV certificate that impersonates workplace apps to deploy legitimate RMM tools and establish persistent backdoors; OAuth redirection abuse used to convert trusted auth flows into phishing and malware delivery vectors; developer-targeting supply‑chain attacks using malicious Next.js repositories to trigger covert RCE→C2 chains during standard build workflows. Additional posts cover AI threat‑modeling, risks from self‑hosted agents (OpenClaw‑