Signed malware impersonating workplace apps deploys RMM backdoors

Microsoft Security Blog highlights several high-risk trends: signed malware using a stolen EV certificate to impersonate workplace apps and deploy legitimate RMM tools for persistent backdoors; OAuth redirection abuse being weaponized to convert trusted authentication flows into phishing/malware delivery paths; and developer-targeting campaigns that hide RCE-to-C2 chains inside standard Next.js build workflows. The posts also call out growing risk from self-hosted agents (OpenClaw-style) and common agent misconfigurations, and recommend hardening certificate controls, monitoring and auditing R