According to this article from the Malware Protection Center blog on TechNet, stolen certificates are becoming more common, with several malicious programs being distributed with files that were signed with stolen certificates issued by several different Certification Authorities. The article contains a link to Microsoft’s best practices for code-signing, that includes tips on how to keep your private keys private. Check it out here:
http://blogs.technet.com/b/mmpc/archive/2013/12/15/be-a-real-security-pro-keep-your-private-keys-private.aspx?
