Reported by 1 outlet
DigiCert breached — 27 EV code-signing certificates stolen and used to sign Zhong Stealer malware
Why this score
- Breadth
- 0.50 / 2.0 · 1 source
- Authority
- 1.00 / 2.0 · best outlet weight
- Severity
- 0.70 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
DigiCert breached — 27 EV code-signing certificates stolen and used to sign Zhong Stealer malware
cyberinsider.com · 156d ago · May 11th, 2026
A threat actor compromised DigiCert's internal support environment through a social engineering attack on April 2, 2026, ultimately stealing 27 Extended Validation code-signing certificates that were used to sign Zhong Stealer malware payloads. The attacker impersonated a customer in a Salesforce-based support chat and repeatedly sent a malicious ZIP archive containing a
.scrscreensaver executable. After four blocked attempts, a support analyst executed the payload on April 2. While DigiCert's Trust Operations team contained that initial compromise within hours, a second endpoint was silently infected on April 3 — and because its CrowdStrike EDR agent was misconfigured and not reporting to the central management console, the attacker maintained undetected access for nearly two weeks. Using the compromised support account's proxy access to customer accounts, the attacker harvested initialization codes for pending EV certificate orders. Possession of an initialization code plus an approved order was sufficient to generate a valid EV certificate. In total, 60 certificates were revoked (27 directly linked to the attacker, 11 confirmed signing Zhong Stealer malware, 33 as precaution). The stolen certificates were issued in the names of legitimate companies including Lenovo and Kingston. The Zhong Stealer campaign has been linked to GoldenEyeDog (APT-Q-27), a Chinese cybercrime group involved in cryptocurrency theft, though attribution for the DigiCert intrusion itself remains unconfirmed. DigiCert has since masked initialization codes in all support workflows, tightened MFA requirements, and suspended affected analyst accounts. Organizations should audit any binaries signed with DigiCert EV certificates from April 2–17, verify EDR coverage across all endpoints with access to trust infrastructure, and implement MFA on all support portal functions that retrieve credentials or keys.