AppSuite-PDF, PDF Editor Operators Exploited 26 Code-Signing Certificates to Fake Legitimacy

Analysis by GBHackers News, in collaboration with CertCentral[.]org, identifies that AppSuite-PDF and the PDF Editor campaigns abused at least 26 distinct code-signing certificates issued to 24 companies in places such as Panama, Malaysia, the United States, and the British Virgin Islands, over the past seven years to sign BaoLoader components.

The certificates were obtained from trusted authorities including DigiCert, GlobalSign, SSL[.]com, Entrust, and Sectigo, enabling the apps to bypass security controls by impersonating legitimate providers. The researchers note that unusually, the actors secured multiple certificates for the same organisational identity from different issuers on 11 occasions, implying they procured the certificates themselves rather than buying resold ones. Signer names like GLINT SOFTWARE SDN. BHD., ECHO INFINI SDN.

BHD., and Summit Nexus Holdings LLC appear repeatedly on VirusTotal submissions dating back to mid-2025, with a cluster of certificates under Apollo Technologies Inc., Caerus Media LLC, and Onestart Technologies LLC used to sign OneStart installers. Prior to these campaigns, the same actors operated under identities such as Digital Promotions Sdn.

Bhd., Eclipse Media Inc., Astral Media Inc., and Blaze Media Inc. to distribute Web Companion installers and PUPs, tied to a BaoLoader umbrella through shared naming conventions.