Hackers Exploit Windows Policy Loophole to Forge Kernel-Mode Driver Signatures and Target Chinese-speaking Microsoft Users

Threat actors, primarily native Chinese-speaking, are exploiting a Microsoft Windows policy loophole to forge signatures on kernel-mode drivers. By altering the signing date of drivers, malicious and unverified drivers signed with expired certificates can be loaded onto systems, providing complete access and compromise. Microsoft has taken steps to block all certificates and suspend developer program accounts involved in the incident. The weakness in Windows certificate policies allows threat actors to deploy thousands of malicious, signed drivers without submitting them for verification. Open-source tools such as HookSignTool and FuckCertVerifyTimeValidity are used to forge the signatures.