It is a sad day when a PKI private key signing software is able to sign code on behalf of Microsoft.  Especially when it is found in the wild and for nefarious use.  Public information can be found @ http://www.zdnet.com.au/microsoft-hole-allowed-hackers-to-sign-code-339339044...

Confidentiality clauses prevent me from speaking too much about how / when / where , etc but you will want to cleanse your systems of these keys: 

https://github.com/aeonsf/Operational_Security/commit/cc7a6ca1da67b0ab778efd5...

​