A fake antivirus program is using at least a dozen stolen code-signing certificates, indicating hackers are regularly breaching the networks of developers.