Poisoned Pipeline / Techniques / T0215
Enroll attacker-owned code-signing identity
The attacker registers or purchases their own legitimate code-signing
identity — an Apple Developer ID, a Windows Authenticode certificate, or
a marketplace publisher account — and signs malware with it. macOS
notarization and Gatekeeper then pass with no warning dialog, and
signature-based allowlists see a valid, unrevoked signature. Distinct
from T0208 (Compromise code-signing identity): there the cryptographic
identity belongs to the vendor and was stolen or misissued; here the
identity is genuinely the attacker's, obtained through the normal
enrollment process. That means vendor-side certificate hygiene cannot
prevent it — only teardown of the certificate after the fact, and
provenance checks on the distribution channel, apply.
Where this idea came from
This catalogue, from the MacSync fake-installer wave (OSM verified report, initial intel Jamf Threat Labs) where every lure DMG was signed and notarized by the OSMAN ASTUR Developer ID — an identity the attacker enrolled themselves, not a stolen vendor certificate.
- https://opensourcemalware.com/domain/claude-desktop.com
- https://www.jamf.com/blog/macsync-stealer-evolution-code-signed-swift-malware-analysis/
Mitigations
- M1090 Implement code and image signing
- M1500 Verify third-party artifacts and open-source libraries
- M1590 Implement artifact signing and verification
Detections
- D1090 Implement package or image integrity verification
- D1510 Implement Intrusion Detection System and anti-malware
- D1520 Implement endpoint detection and response system
Observed in incidents (2)
- AppleJeus fake crypto trading apps carried malware from vendor-run sites
- MacSync via signed fake Claude Desktop installers on a lookalike download site