The official blog of VirusTotal, a malware scanning service now owned by Google, covering product launches and threat research.
HN links it for malware research, such as a post on malicious JAR files appended to signed MSI files, which commenters discuss in terms of signature trust.
By “scanner” I meant the built-in windows defender tooling, which is - afair - affected. It trusts the signature. But you’re entirely correct - a virus scanner that does not rely on the signature w could catch the malicious code.
However, this blog post mentions that various security solutions trust the windows code signing, but it does not mention which ones - https://blog.virustotal.com/2019/01/distribution-of-malicious-jar-appended.html?m=1