DigiCert, a major Certificate Authority, recently suffered a significant security breach where hackers used a malicious screensaver file to steal 60 Extended Validation (EV) Code Signing certificates.
These highly trusted certificates were subsequently used to sign the “Zhong Stealer” malware, allowing the malicious files to bypass security warnings by appearing as legitimate software.
The incident began in early April 2026, when a sophisticated threat actor contacted DigiCert’s customer support team via a Salesforce chat channel.
The attacker repeatedly sent a ZIP file disguised as a standard customer issue screenshot. Hidden inside this ZIP archive was a malicious .scr (screensaver) executable file containing a dangerous payload.
While DigiCert’s security measures successfully blocked the first four delivery attempts, a fifth attempt successfully compromised a support analyst’s computer.
Exploiting the Support Portal
Once the hackers gained control of the compromised computer, they accessed DigiCert’s internal support portal. They utilized a specific support tool that allows analysts to view accounts from a customer’s perspective.
While this access was restricted and did not allow the attackers to submit new orders or change passwords, it did expose a critical vulnerability: initialization codes for EV Code Signing certificates that had been approved but not yet delivered.
Because the threat actor had access to the initialization codes and approved orders, they were able to obtain valid certificates across multiple customer accounts fraudulently.
DigiCert identified that the attackers successfully generated 60 EV Code Signing certificates across four different Certificate Authorities.
The hackers issued these certificates under the names of legitimate, well-known technology companies, including Lenovo, Kingston, Shuttle Inc., and Palit Microsystems.
Of the 60 stolen certificates, at least 27 were explicitly linked to malicious activity.
Cybersecurity community members reported that these trusted certificates were actively used to digitally sign “Zhong Stealer,” a known malware family. As a strict precaution, DigiCert treated all 60 certificates as fully compromised.
Incident Response and Remediation
Upon realizing the full scope of the breach by mid-April, DigiCert took immediate action to contain the threat, as reported by Mozilla.
All 60 compromised certificates were revoked within 24 hours of discovery, and all pending code-signing orders exposed during the compromise window were canceled.
To secure their infrastructure against similar attacks, DigiCert implemented several critical system updates. They deployed immediate code changes to completely hide initialization codes from support users at both the user interface and API levels.
Furthermore, the company suspended the affected analyst accounts and disabled Okta FastPass for the support portal. It enforced stricter multi-factor authentication (MFA) requirements.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
 Code Signing certificates.){kind=link}