Fake Screenshot ZIP Led to DigiCert Cert Theft

How the attack worked

The intrusion began in a customer support chat channel rather than an inbox. A threat actor contacted DigiCert's support team and delivered a ZIP file disguised as a customer screenshot. Instead of an image, the file contained a .scr executable carrying a malicious payload. Once opened by a support analyst, the malware gave the attacker a foothold on that employee's device and, from there, access into DigiCert's internal support portal.

From inside the portal, the attacker was able to view EV code-signing certificate initialization codes tied to approved-but-pending orders. That access let them obtain and misuse customer certificates, ultimately using some of them to sign malware, including artifacts linked to Zhong Stealer, so the malicious files would appear trustworthy and evade detection. Researchers at Expel attributed the activity to a cluster called CylindricalCanine, described as a sub-group of GoldenEyeDog, and connected the tooling to Golden Gh0st RAT.

Why it succeeded

The pretext relied on a routine, low-friction interaction: a customer sharing a screenshot in a support conversation. Support staff are trained to be responsive and helpful, and reviewing an attached file from someone claiming to be a customer is a normal part of that job. The disguise worked because the file type mismatch, a ZIP containing an executable rather than an image, was not an obvious red flag in the flow of a busy support queue.

The impact was amplified by portal features that let authenticated support analysts act on behalf of customer accounts. That capability, useful for legitimate support work, also meant a single compromised analyst session could expose sensitive data like certificate initialization codes.

What to watch for

• A

How did attackers gain access to DigiCert's support systems?

A threat actor contacted DigiCert's support team through a customer chat channel and delivered a ZIP file disguised as a customer screenshot. The file actually contained a .scr executable with a malicious payload.

What did the attackers do once inside?

They abused DigiCert's support portal features to view and intercept EV code-signing certificate initialization codes for approved-but-pending orders, then used those to obtain and misuse customer certificates.

Were the stolen certificates used for anything specific?

DigiCert revoked 60 certificates, with 27 explicitly linked to the threat actor, and some were used to sign Zhong Stealer malware artifacts to help it evade detection.

Is this the same tactic used elsewhere?

Expel noted the same group, tracked as CylindricalCanine (a GoldenEyeDog sub-group), also distributes files disguised as screenshots through phishing emails and support portal submissions.