Security researchers say threat actors are using two of Nvidia's code-signing certificates leaked by the Lapsus$ group to sign Windows malware and hacking tools
it wants $NVDA to stop limiting crypto mining on its GPUs and to open source its drivers. The deadline was Friday. No news on if Nvidia is negotiating or if the hackers will make do on the threat to leak everything. https://twitter.com/...
Context & Ripple Effects
This is the escalation stage of a week-long Lapsus$ campaign against Nvidia. The group claimed a 1TB haul including DLSS source code on March 1, then moved to leverage: it demanded Nvidia remove crypto mining limits and open source its GPU drivers by Friday, threatening to dump everything otherwise. Along the way, 71K+ employee credentials surfaced on Have I Been Pwned, many already cracked.
The new development is that the stolen material is now operationally live: two of Nvidia's code-signing certificates are being used to sign Windows malware and hacking tools, turning a data-theft story into an active trust problem for every Windows machine that implicitly trusts Nvidia-signed binaries.
First-order effects
- Malware and hacking tools signed with Nvidia's certificates can present as trusted vendor software to Windows, degrading the OS's signature-based defenses for users right now.
- Nvidia is forced into certificate revocation and reissuance, disrupting its own driver-signing pipeline while the extortion deadline over crypto mining limits and open-sourcing drivers has already passed without public word of negotiations.
Second-order effects
- The episode hands Lapsus$ a template other groups will copy: steal signing infrastructure alongside source code, so each future breach yields both ransom leverage and immediately usable attack tooling.
- Windows defenders and enterprise security teams must tighten scrutiny of vendor-signed binaries, raising validation costs across the software supply chain far beyond Nvidia's own ecosystem.
Third-order effects
- If breaches keep yielding valid code-signing certificates, the industry will be pushed toward shorter-lived certificates and hardware-bound key storage, since a single leaked cert currently vouches for arbitrary malicious code.
- Extortion is structurally shifting from pure ransom demands to policy demands — here, forcing product changes (mining limits) and engineering changes (open sourcing drivers) — meaning attackers increasingly target how companies build, not just what they hold.
The trend: Extortion groups are converting stolen corporate secrets into both working attack tools and negotiating leverage, making code-signing infrastructure a primary breach target.