Signed malware impersonating workplace apps deploys RMM backdoors

Microsoft Security Blog posts highlight multiple high-risk trends: signed malware using a stolen EV certificate to impersonate workplace apps and deploy legitimate RMM tools as persistent backdoors; OAuth redirection abuse as a trusted-phish/malware delivery vector; developer-targeting campaigns delivering staged RCE→C2 via malicious Next.js repositories; and growing risks from self-hosted agents (OpenClaw-like) and common agent misconfigurations. Guidance across the posts emphasizes hardening certificate controls and code-signing, monitoring RMM and OAuth redirection telemetry, securing CI/CD