Hackers targeted DigiCert's support team by delivering malware disguised as a screenshot through a customer chat channel, infecting two analyst endpoints. From the infected systems, attackers accessed DigiCert's internal support portal, leveraging a feature that allows support analysts to proxy into customer accounts. This access enabled them to obtain initialization codes and approved orders necessary to fraudulently issue EV Code Signing certificates across multiple customer accounts and certificate authorities. DigiCert discovered and revoked 60 certificates by mid-April 2026, including 27 linked to the threat actor, some of which were used to sign the Zhong Stealer malware family. The company responded by canceling pending orders, revoking certificates, and implementing stronger security measures such as multi-factor authentication for administrative workflows and restrictions on file types in support channels. The investigation found no evidence of other internal system misuse beyond the code signing initialization codes.

The attackers were able to fraudulently obtain EV Code Signing certificates, which could undermine trust in software signed with these certificates. Eleven of the revoked certificates were used to sign malware (Zhong Stealer), indicating active abuse. The incident compromised the integrity of DigiCert's certificate issuance process for a limited set of customer accounts. However, DigiCert's prompt revocation of certificates and cancellation of pending orders mitigated further misuse. No evidence was found of broader internal system compromise beyond the code signing initialization codes.

DigiCert has revoked all certificates potentially linked to the incident and canceled pending certificate orders to prevent further abuse. The company has implemented multi-factor authentication for administrative workflows, restricted access to initialization codes from proxied support users, limited allowable file types in support chat and case attachments, and enhanced logging capabilities. Organizations relying on DigiCert certificates should verify certificate validity and update any software signed with revoked certificates. Patch status is not applicable as this is an incident response to a compromise rather than a software vulnerability.