Counterfeit certificates sold online make digitally signed malware a snap

So where are these certificates coming from? I don’t suppose the criminals have the CA keys.