Same Softonic Cert Signs a RustDesk Impostor and a Near-Clean Twin
A Win32 installer bearing Softonic International SA's code-signing certificate exists in two forms: one flagged by 31 of 76 antivirus engines under aliases impersonating RustDesk and Lenovo Vantage, the other nearly invisible at 4 of 76. Both share the identical certificate serial and compile timestamp, pointing to a single build pipeline rather than two unrelated actors.
A Win32 installer signed with the identical Softonic International SA code-signing certificate turns up in two forms with wildly different fortunes: one build draws 31 of 76 antivirus detections and ships under aliases that impersonate RustDesk and Lenovo Vantage, while its cert-mate scores a near-clean 4 of 76 and drew almost no submissions at all.
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read