Code-Signing Abuse × DigiCert EV Code Signing Certificates

Attackers compromised DigiCert's internal support systems... fraudulently obtained valid certificates and used them to sign Zhong Stealer malware.

Threat actor impersonated a customer, sent a malicious ZIP containing a .scr file to support chat. A support employee executed it, compromising a workstation. Due to missing EDR on a second endpoint, attackers maintained access for two weeks, harvesting initialization codes from the support portal's proxy view to generate valid EV code-signing certificates.

Monitor code-signing certificate issuance logs for anomalies such as unusual certificate requests, rapid successive approvals, or certificates issued outside normal business processes. Implement strict access controls and multi-factor authentication for certificate issuance systems, and deploy EDR on all endpoints to detect and block malicious scripts or executables used in initial compromise.