2033170 - DigiCert: Misissued code signing certificates
DigiCert misissued code signing certificates after threat actor compromised customer support, signed malware.
DigiCert disclosed that a threat actor compromised a customer support team member and obtained initialization codes for a limited number of code signing certificates, some of which were used to sign malware. The affected certificates were revoked within 24 hours of discovery and pending orders in the affected window were cancelled. The incident triggered compliance reviews across Mozilla, Microsoft, Apple, Chrome, and CABF root programs.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Microsoft?
Get an email when a new story names Microsoft, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA threat actor compromised a DigiCert customer support team member's account and used it to obtain initialization codes for code signing certificates, which were then used to sign malware. This incident demonstrates how privileged account compromises can cascade into supply chain attacks, as code signing certificates are fundamental trust mechanisms used by software vendors and end users. The breach required revocation of affected certificates within 24 hours and triggered compliance reviews across major browser and certificate authority oversight programs, highlighting the critical importance of protecting privileged accounts at certificate authorities.
What helps against this
How we list vendors- Privileged access management (PAM)
Admin accounts stop being one stolen password away from control of everything.
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Incident response retainer
Experts are on call before the worst day, not searched for during it.