Reported by 1 outlet

Timeline

1. original reporting

   DigiCert CA Compromise — Social Engineering via Support Chat Steals EV Code-Signing Certificates to Sign Zhong Stealer Malware — 60 Certificates Revoked

   bleepingcomputer.com · 140d ago · May 27th, 2026

   One of the most consequential attacks on public-key infrastructure this year unfolded at DigiCert in early April. A threat actor posed as a customer via the support chat channel, delivering a malicious .scr file disguised as a screenshot inside a ZIP archive. After four failed delivery attempts (blocked by CrowdStrike sensors), a fifth attempt compromised ENDPOINT1 on April 2. A second analyst endpoint was compromised on April 4 and went undetected for nearly two weeks — it lacked a CrowdStrike sensor entirely.

   Attackers used the compromised support endpoints to access DigiCert's internal customer portal, exploiting a proxy feature that lets support staff view accounts from the customer's perspective. This allowed them to extract initialization codes for approved but pending EV Code Signing certificate orders — along with the hardware token PIN and software needed to retrieve the certificates and their key material.

   27 certificates were stolen and used to sign Zhong Stealer malware (associated with Chinese GoldenEyeDog / APT-Q-27), enabling it to bypass Windows SmartScreen and other trust-based defenses. DigiCert revoked 60 certificates total (27 confirmed stolen, 33 precautionary) across 13 countries, affecting customers including Shuttle, Lenovo, Palit, Tencent (TikTok), and security firm DigiFors. Root cause: missing endpoint coverage on a critical support machine, inadequate risk analysis for certificate initialization code access, and a Salesforce customer portal that blindly forwarded malicious attachments to support staff.

   ---