Midnight Vendor: How Hackers Buy Legitimate Software Signing Certificates on the Dark Web The antivirus trusts it, Windows allows it, and the blue box indicates 'Verified Publisher,' but at the same time, a developer double-clicked on a file signed with a digital signature stolen three months prior

Abstract

This article reveals how cybercriminals bypass the software trust system by purchasing legitimate code signing certificates—including Extended Validation (EV) certificates—on dark web marketplaces like those operated by vendors such as "VoidCert." These certificates are stolen from real software companies through compromised build systems, exposed private keys (e.g., .pfx files in misconfigured S3 buckets or CI/CD pipelines), or abused hardware tokens. Once obtained, attackers sign malware that fully bypasses Windows SmartScreen and antivirus protections, displaying a "Verified Publisher" message to victims. The article cites a 340% increase in the underground trade of stolen certificates since 2022 (Recorded Future, 2026), and gives real examples such as the RansomHub attack in July 2025. It concludes that the root problem is not cryptographic weakness but broken human processes and incentives, and proposes urgent fixes: mandatory CA audits, faster revocation propagation, and treating signing keys as critical infrastructure—especially for Pakistani software firms.