NewsPublished 4 May 2026

DigiCert Revokes Certificates After Support Portal Hack

Source SecurityWeek

Description

Hackers delivered malware via a customer chat channel, infected an analyst’s system, and accessed the internal support portal. The post DigiCert Revokes Certificates After Support Portal Hack appeared first on SecurityWeek .

Impact

The attackers were able to fraudulently obtain EV Code Signing certificates, which could undermine trust in software signed with these certificates. Eleven of the revoked certificates were used to sign malware (Zhong Stealer), indicating active abuse. The incident compromised the integrity of DigiCert's certificate issuance process for a limited set of customer accounts. However, DigiCert's prompt revocation of certificates and cancellation of pending orders mitigated further misuse. No evidence was found of broader internal system compromise beyond the code signing initialization codes.

Defensive guidance

DigiCert has revoked all certificates potentially linked to the incident and canceled pending certificate orders to prevent further abuse. The company has implemented multi-factor authentication for administrative workflows, restricted access to initialization codes from proxied support users, limited allowable file types in support chat and case attachments, and enhanced logging capabilities. Organizations relying on DigiCert certificates should verify certificate validity and update any software signed with revoked certificates. Patch status is not applicable as this is an incident response to a compromise rather than a software vulnerability.

References

securityweek.com/digicert-revokes-certificates-after-support-portal-hack/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 4 May 2026, 12:51 UTC

References

Community reviews