Threat actors are using NVIDIA's code-signing certificates leaked by the Lapsus$ group to sign Windows malware and hacking tools
Threat actors are using stolen NVIDIA code signing certificates to sign malware to appear trustworthy and allow malicious drivers to be loaded in Windows.
Context & Ripple Effects
NVIDIA had already confirmed that hackers leaked employee and proprietary information; the reported certificate use turns that disclosed data leak into an immediate abuse of software trust on Windows.
The incident matters beyond stolen source material because signed code can cross the boundary between an untrusted file and software Windows will accept, particularly when drivers are involved.
First-order effects
- Threat actors can make malware and hacking tools appear to come from NVIDIA, increasing the risk that Windows users and defenders treat those files as legitimate.
- Windows systems that accept the signed malicious drivers are exposed to code loading under the authority conveyed by NVIDIA's leaked certificates.
Second-order effects
- NVIDIA's signing identity becomes a security liability for customers and partners that rely on it as a provenance signal, while Windows defenders must distinguish certificate-backed malware from legitimate NVIDIA software.
- The later report that Windows Hardware Developer Program-certified drivers were also used to sign malware shows that abuse of trusted driver-signing paths is not confined to NVIDIA's leaked certificates.
Third-order effects
- Repeated misuse of vendor and platform signing channels would make code-signing reputation a less sufficient security control, pushing trust decisions toward stronger validation of the software and its delivery path.
- The pattern places compromised software distribution alongside signed-driver abuse as a durable attack surface, as illustrated by the later modified CyberLink installer supply-chain attack.
The trend: Software trust is becoming a primary attack target as attackers exploit compromised certificates, certified drivers, and legitimate installers to make malicious code acceptable to endpoint defenses.