DigiCert Revokes Fraudulently Obtained Certificates Following Cyberattack On April 2, digital certificate authority DigiCert fell victim to a cyberattack after a threat actor targeted its support team with malware disguised as a screenshot in a customer chat channel. The malicious payload infected two endpoints one detected on April 3 and another on April 14, with the delayed discovery of the second infection attributed to malfunctioning security tools. The attackers exploited a limited-access function in DigiCert’s internal support portal, leveraging the ability of authenticated support analysts to proxy into customer accounts. This allowed them to obtain initialization codes for pending Extended Validation (EV) Code Signing certificate orders. With these codes and approved orders, the threat actor successfully issued fraudulent certificates across multiple customer accounts and certificate authorities (CAs). By April 17, DigiCert identified and revoked 60 certificates tied to the incident, including 27 directly linked to the attacker. Of these, 11 were reported by the cybersecurity community and had been used to sign the Zhong Stealer malware. The company confirmed that no other internal systems were compromised beyond the unauthorized access to initialization codes. In response, DigiCert revoked all potentially affected certificates, canceled pending orders to block further exploitation, and implemented stricter security measures. These include enforcing multi-factor authentication (MFA) for administrative workflows, restricting support users from accessing initialization codes, limiting file types in support chats and Salesforce case attachments, and enhancing logging capabilities.