Signed Adware Operation Disables Antivirus Across 23,000 Hosts (infosecurity-magazine.com)

• 23,000 endpoints affected with antivirus disabled
• Signed updates used as vector for payload delivery
• Supply chain attack targeting security software

"Huntress uncovers a signed adware campaign that deploys AV-killing payloads via tampered updates across 23,000 endpoints. Attackers leverage valid signatures to bypass security software."