DigiCert: malware sent through support chat let an attacker obtain EV code-signing certificates

What happened

• DigiCert’s incident report (Mozilla Bug 2033170): an attacker posing as a customer sent a malicious ZIP containing a .scr file through support chat on 2 Apr 2026, compromising one support analyst endpoint and then a second on 4 Apr that had no CrowdStrike sensor installed. From those endpoints the attacker used an internal support-portal proxy function where initialization codes for approved, pending EV Code Signing orders were not masked, and used them to obtain certificates. 60 certificates across four CAs (including GoGetSSL intermediates) were revoked: 27 linked to the attacker, 33 as a precaution. Some signed “Zhong Stealer” malware.
• Root causes listed by DigiCert: inconsistent EDR coverage; excess privilege in the support-portal proxy function; initialization codes treated as workflow data rather than bearer credentials; executable attachments allowed in support chat and Salesforce. Okta FastPass let the attacker satisfy MFA from the compromised device.
• The Hacker News later reported Expel tying the activity to a GoldenEyeDog subgroup (secondary).
• Last certificate revoked 17 Apr; remediations include masking codes, blocking .exe/.scr/.zip at ingestion, phishing-resistant MFA, and dual authorization for certificate-impacting proxy actions.

Sources

• https://bugzilla.mozilla.org/show_bug.cgi?id=2033170
• https://www.helpnetsecurity.com/2026/05/04/digicert-breach-code-signing-certificates-malware/

This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.