Understanding the Status and Strategies of the Code Signing Abuse Ecosystem

Understanding the Status and Strategies of the Code Signing Abuse Ecosystem

Speakers: Hanqing Zhao

Conference: NDSS Symposium 2026

YouTube: https://www.youtube.com/watch?v=ih0XF-kXAN0

Overview

Code signing is the primary mechanism for verifying software authenticity and integrity, but attackers have systematically exploited weaknesses in the code signing PKI to sign malware with valid certificates from trusted CAs. This talk presents the largest study of code signing abuse, analyzing over 3.2 million signed malicious samples and identifying 43,000+ abused certificates across 46 publicly trusted CAs in over 100 countries. The researchers classify abuse into five types, discover ghost certificates -- abused certificates that cannot be revoked due to design flaws in the PKI -- and find that 38% of unrevoked certificates are ghost certificates. Advanced abuse (stolen certificates, fake identities) is growing sharply, with stolen certificates taking an average of 66 days to be detected and revoked. Nearly 23% of revocation date values are inaccurate. The research reveals that attackers exploit identity verification differences across countries to obtain certificates in less strict jurisdictions and use certificate polymorphism (multiple certificates from similar identities) to maintain persistent signing capability.

Background

▶ Watch: Code signing abuse: attackers signing malware with trusted certificates (1:30)

Code signing uses PKI to bind a developer identity to software: developers purchase certificates from CAs, sign binary hashes, and operating systems verify the chain of trust before execution. Valid signatures reduce security warnings and bypass some OS enforcement checks. Abuse occurs when attackers obtain certificates using fraudulent identities, stolen certificates, or compromised developer accounts and use them to sign malware. Roughly 1 million malware samples with abused signatures have been reported since 2021.

Key Findings

▶ Watch: Dataset: 3.2M samples, 43K abused certificates, 46 CAs, 100+ countries (6:00)

Five abuse types classified: (1) self-signed untrusted certificates, (2) copied certificates/signatures from benign software, (3) certificates obtained with fake/shell company identities, (4) stolen certificates from legitimate companies, and (5) compromised developer signing infrastructure. Types 1-2 are detectable by signature validation; types 3-5 require ground truth from CA revocation reasons and business registration databases.

Ghost certificates cannot be revoked: When an issuing certificate expires, is revoked, or the CA ceases operations, no entity can publish revocation information for certificates issued by that CA. These "ghost certificates" remain permanently valid. 38% of unrevoked abused certificates in the dataset are ghost certificates.

Revocation is ineffective: Overall revocation rates are low, and even among revoked certificates, 23% have inaccurate revocation dates, meaning signed malware may still be considered to have valid signatures with trusted certificates.

Attacker strategies include: exploiting cross-country identity verification differences (obtaining certificates from CAs in less strict jurisdictions), preferring short-lived certificates (cheaper, reduced loss if revoked), and certificate polymorphism (same/similar identity obtaining multiple certificates -- over 3,000 clusters identified).

Technical Deep Dive

▶ Watch: Advanced abuse growing sharply; stolen certs take 66 days to detect (8:00)

The dataset combines private sources (from a security company partner) and public datasets (VirusShare), totaling 3.2 million samples. Code signing features are extracted, signatures validated, and certificate revocation status checked via CRL/OCSP. Business registration databases verify company legitimacy, enabling classification of abuse types. CA revocation reasons provide ground truth for distinguishing stolen vs. fraudulent identity cases.

Demo / Proof of Concept

▶ Watch: Certificate polymorphism: 3,000+ clusters of similar identity certificates (11:30)

The ecosystem-wide analysis spans 43,000+ abused certificates, 46 CAs, 100+ countries, demonstrating this is a global systemic problem rather than isolated incidents. At least two malware campaigns were identified using specific certificate abuse strategies. The ghost certificate phenomenon was validated by showing that expired/revoked issuer certificates leave child certificates permanently unrevocable.

Defensive Implications

▶ Watch: Recommendations: transparency, proactive detection, ghost cert mitigation (13:30)

For CA/Browser Forum and code signing governance, certificate transparency should be extended to code signing (currently opaque compared to web PKI). Proactive abuse detection, monitoring for certificate polymorphism clusters, and mandatory minimum revocation infrastructure lifetimes could reduce abuse. For OS vendors, the ghost certificate problem requires supplementary blocklists beyond CRL/OCSP. For enterprise security teams, the 66-day average detection time for stolen certificates means malware signed with stolen certs can circulate undetected for months.

Key Takeaways

• 43,000+ abused code signing certificates identified across 46 CAs in 100+ countries
• Ghost certificates (38% of unrevoked) cannot be revoked due to PKI design flaws
• 23% of revocation dates are inaccurate, undermining revocation effectiveness
• Advanced abuse (stolen certs, fake IDs) is growing sharply with 66-day average detection time
• Attackers exploit cross-country identity verification differences and use certificate polymorphism
• Code signing ecosystem lacks the transparency of web PKI, enabling systemic abuse

About the Speaker(s)

Hanqing Zhao is from Tsinghua University. The research is a joint work with Qihoo Labs and Tianning Technology Research Institute, combining large-scale malware analysis with code signing PKI investigation.