Code-Signing-Aware Cooldown And Reputation Layer For Mainstream Windows Installers After The DAEMON Tools Compromise
DAEMON Tools' official, validly-signed installer was trojanized for nearly a month (versions 12.5.0.2421-2434) before discovery, hitting victims in 100+ countries. eScan, Notepad++, CPU-Z, and now DAEMON Tools have all been hit via signed-installer supply chain attacks in 2026. Non-developer Windows users have no equivalent of npm install cooldowns or reputation gates. The opportunity is a lightweight Windows-side install gate that delays running newly-published versions of well-known utilities until they accumulate clean telemetry from a wider population.
The non-obvious wedge is normies, not enterprise. Enterprise has Defender ATP and approval workflows. The home user installing CPU-Z to check thermals has nothing. A free, opinionated gate with a 'hold for 72 hours' default and a community telemetry feed is shippable as a tray app.
landscape (3 existing solutions)
Windows still treats 'signed by the vendor' as proof of trust, but the last four months show vendor signing keys plus official websites are exactly the new attack surface. There's no consumer-friendly Windows tool that says 'this binary just shipped, let's wait 72 hours and watch what it does on other people's machines first'.