AnyDesk Says Situation Is Under Control After Reports of Possible Stolen Signing Certificate
Summary
Huntress reported concern about a possibly compromised AnyDesk signing certificate after a maintenance period and certificate change. AnyDesk said it had no evidence end-user devices were affected and urged users to install the latest version with the new certificate.
Key points
- The suspected compromise was initially unconfirmed; Huntress cited an unexpected 48-hour maintenance period and a signing-certificate change in AnyDesk version 8.0.8.
- AnyDesk said the situation was under control and that it had no evidence end-user devices were affected.
- AnyDesk advised users to use the latest version with the new code-signing certificate.
- Huntress recommended auditing anomalous AnyDesk use and other programs signed with the same certificate details.
- A community YARA rule was shared to detect binaries signed with the potentially compromised certificate; Huntress said it was developing related detection for its managed EDR.
Article Details
- Event Type
- Advisory about a possible compromise and theft of AnyDesk’s code-signing certificate; the reported compromise was initially unconfirmed speculation.
- Impact
- A potentially compromised certificate could allow malicious programs signed with the AnyDesk certificate to be trusted by antivirus software. AnyDesk stated it had no evidence that end-user devices were affected and that the situation was under control; the article also recommends auditing anomalous AnyDesk use and binaries bearing the certificate.