The Install Looked Legitimate. The Certificate Checked Out. It Still Handed an Attacker Remote Control
Active Campaign Vendor & Access Risk September 2026 · 6 min read Microsoft's security researchers just walked through a campaign where the file really was signed. The install really did work exactly as advertised. And by the time anyone noticed, attackers had remote access to the machine anyway, through software meant to help, not harm. A contractor shows up wearing the right uniform, driving the right van, carrying a badge that scans as valid. You let them in. Why wouldn't you? Everything checked out. The badge was stolen. The uniform was too. The van was real, but not theirs. That's close to what Microsoft's Defender Experts team described in research published this year. A phishing campaign sent out fake meeting invitations and fake PDF attachments, the kind most people have learned to eye with at least some suspicion by now. But the payload inside wasn't a crude, obvio...