🔓 DigiCert Breach, 🐧 Dirty Frag Exploited, 📚 Canvas Extortion, 🎣 HookedWing Phishing, 🔒 GhostLock File Lock

The DigiCert breach is the day's defining story. A social engineering attack on a support analyst netted 27 Extended Validation code-signing certificates, which were used to sign Zhong Stealer payloads, and a misconfigured EDR agent left a second endpoint running silently. EV certificates are the strongest trust anchors in the Windows ecosystem, so anything signed with them until revocation carries a veneer of legitimacy. DigiCert breached: 27 EV code-signing certificates stolen and used to sign Zhong Stealer malware

Operation HookedWing shows the value of patience in credential harvesting. Active since 2022, the campaign has collected more than 2,000 credentials from 500-plus organizations across aviation, energy, and government, using GitHub-hosted Outlook lookalikes that pre-fill the victim's organization. Low-noise, long-arc phishing defeats burst-based detection, and the infrastructure keeps evolving. Operation HookedWing: 4+ year phishing campaign steals 2,000+ credentials from 500+ organizations

GhostLock is a reminder that ransomware is not the only way to paralyze a business. Exclusive deny-share handles can lock 500,000 files in under three minutes without a single write event, leaving honeypots, canary files, and write-rate analytics blind; storage-management session telemetry is the only signal that sees it. Separately, cPanel operators should treat the newly detailed Perl injection path as urgent given the mass exploitation of the related authentication bypass one week earlier.