Hackers Trick DigiCert Into Issuing Certificates Used to Sign Malware
On 2 April 2026, DigiCert’s support team became the target of a carefully planned attack, which allowed hackers to steal EV Code Signing certificates by simply pretending to be a customer in a help chat.
According to DigiCert’s official advisory and incident response report (filed as Bug 2033170 in Mozilla’s CA compliance tracker), the attacker contacted a support agent via a chat channel and sent a ZIP file disguised as a screenshot. This file contained a malicious executable file named k3.exe (an .scr file).
Though DigiCert’s internal security tools caught the threat four times, because agents are expected to open files from customers to provide help, the staff member kept trying. On the fifth attempt, the malware got through and infected the workstation, known as ENDPOINT1.
Based in Utah, DigiCert is one of the world’s largest Certificate Authorities, responsible for verifying that websites and software are legitimate.
A Second Victim
...
Copyright of this story solely belongs to hackread.com. To see the full text click HERE
