2026 DigiCert — support-channel social engineering; unauthorized EV code-signing certificates (Apr)

DigiCert reported that on April 2, 2026 its customer-support channel was targeted by social engineering: a threat actor delivered a malicious ZIP disguised as a screenshot containing a .scr screensaver installer. The attacker abused a limited support-portal function that lets analysts view customer accounts to harvest initialization codes for approved pending orders, ultimately compromising two support endpoints—one contained within 24 hours, a second remaining undetected for almost two weeks due to endpoint-protection gaps. Pairing stolen initialization codes with approved orders allowed issuance of legitimate Extended Validation code-signing certificates; DigiCert revoked 60 certificates (27 tied to attacker activity, including 11 flagged via community malware reports linking certs to Zhong Stealer). Mozilla’s public bug tracker hosts DigiCert’s incident narrative. This is a trust-infrastructure compromise rather than a bulk consumer PII leak.