# Chinese Cyber Group GoldenEyeDog Breached DigiCert to Steal Code-Signing Certificates
## Threat actors exploited customer support portal to compromise trusted certificate authority and obtain signing credentials for malware distribution
A Chinese cybercrime group operating under the name GoldenEyeDog successfully infiltrated DigiCert's internal systems in April 2026, compromising the certificate authority's support infrastructure to steal code-signing certificates intended for legitimate customers. The breach, detailed in recent analysis by security firm Expel, reveals a sophisticated supply chain attack that leveraged social engineering against support staff to gain access to one of the world's most critical infrastructure providers.
The incident represents a critical vulnerability in the trust model that underpins the entire software distribution ecosystem: threat actors who can sign malware with legitimate certificates effectively become invisible to endpoint security controls, which rely on code signatures to validate software legitimacy.
## The Attack: How Access Was Gained
On April 2, 2026, a threat actor posing as a customer contacted DigiCert's support team through the company's customer chat channel, delivering what appeared to be a screenshot in a ZIP file. The archive contained an executable file with a .scr extension and malicious payload—a delivery method designed to evade security filters and appear legitimate to support staff.
The phishing message succeeded, and one or more support analysts executed the malicious file, granting the attackers initial access to DigiCert's internal network. From there, threat actors pivoted to the company's customer-support portal, where they exploited a critical functional vulnerability in the certificate issuance workflow.
The vulnerability was elegant in its simplicity: DigiCert's support portal allows authenticated analysts to access customer accounts from the customer's perspective in order to facilitate support tasks. This access level, intended for legitimate support purposes, inadvertently exposed the ability to retrieve initialization codes for pending EV (Extended Validation) Code Signing certificate orders.
The fatal flaw: possession of an initialization code combined with an already-approved order was "functionally sufficient" to obtain EV Code Signing certificates from multiple Certificate Authorities. This oversight meant attackers didn't need to compromise the certificate issuance servers themselves—they simply needed the credentials already in motion.
## The Scope: 60 Compromised Certificates
DigiCert ultimately revoked 60 code-signing certificates issued through the following certification authorities:
The full scope of potential abuse remains unclear, as the certificates existed in a "pending delivery" state before being intercepted. The compromise affected a "finite set of customer accounts," according to DigiCert's disclosure, but the company has not publicly identified which organizations' legitimate certificates were stolen.
For threat actors, obtaining legitimate code-signing certificates is the Holy Grail of software supply chain attacks. With these credentials, malware can be signed to appear as if it comes from trusted sources, bypassing SmartScreen, Windows Defender, and other signature-based security controls that rely on certificate validity.
## GoldenEyeDog: The Threat Actor Behind the Breach
Expel's attribution links this breach to CylindricalCanine, which it describes as a sub-group of GoldenEyeDog—a Chinese cybercrime organization also tracked under aliases including APT-Q-27, Dragon Breath, and the Miuuti Group.
GoldenEyeDog has operated continuously since at least 2015, with a documented focus on targeting the gambling and gaming sectors. The group historically used counterfeit websites to distribute malware-laced software, but this DigiCert attack demonstrates an evolution in sophistication and ambition. Rather than targeting niche verticals, the group now targets the foundational trust infrastructure that protects all software globally.
### Golden Gh0st RAT: The Malware Framework
Central to GoldenEyeDog's operations is Golden Gh0st RAT, a modified variant of Gh0st RAT (also called Farfli)—a remote access trojan widely adopted by Chinese state-sponsored and criminal groups. Gh0st RAT, originally developed over a decade ago, remains one of the most effective and flexible RAT platforms in active use.
Golden Gh0st RAT is distributed via Golden Gh0st Loader, which itself relies on a multi-stage loader codenamed RONINGLOADER. This delivery chain typically involves:
1. Initial delivery via NSIS installers masquerading as legitimate software (Google Chrome, Microsoft Teams, etc.)
2. Multi-stage loading that decompresses and executes subsequent payloads in memory
3. Evasion techniques to bypass antivirus and endpoint detection systems
In November 2025, Elastic Security Labs documented this exact delivery mechanism. Earlier in 2026, researchers observed GoldenEyeDog using similar tactics in campaigns targeting support staff at Web3 companies, delivering Gh0st RAT through suspicious links sent via customer support chat channels—the same vector used in the DigiCert attack.
### Historical Connections and Pattern Recognition
Security researchers have identified behavioral overlaps between Golden Gh0st RAT and other malware tied to Chinese gambling-industry targeting campaigns. In 2020, Chinese security vendor QiAnXin discovered related malware in a campaign targeting the gambling sector, which had been active since 2019. Additionally, ANY.RUN documented similar payload behavior in February 2025 in connection with Zhong Stealer, another Chinese-origin malware.
This pattern suggests a broader shift in GoldenEyeDog's operational focus: from niche vertical targeting to supply chain compromise and infrastructure theft.
## Implications: Trust Collapse in Code Signing
The DigiCert compromise has far-reaching implications for software security and the trust model underpinning the entire digital ecosystem.
For enterprises and end users:
For certificate authorities:
For software developers:
## Timeline and Technical Details
| Date | Event |
|------|-------|
| April 2, 2026 | Attacker sends phishing message with malicious executable to DigiCert support |
| April 2, 2026 | Support analyst executes malware, granting attacker network access |
| April 2026 | Attackers access customer support portal and retrieve initialization codes for pending EV code-signing orders |
| April 2026 | DigiCert detects the incident and revokes 60 fraudulently obtained certificates |
| July 17, 2026 | Expel publishes detailed technical analysis attributing attack to GoldenEyeDog/CylindricalCanine |
## Recommendations for Organizations
Immediate actions:
Medium-term hardening:
Strategic initiatives:
---
## HackWire Analysis
This incident marks a pivotal moment in the evolution of Chinese cybercrime: GoldenEyeDog has crossed from targeting gaming verticals to compromising the foundational trust infrastructure of the internet. While Gh0st RAT has been known for years, and code-signing attacks have been theoretically understood, this is the first documented case of a Chinese criminal group directly compromising a major certificate authority's internal support infrastructure to steal legitimate signing credentials at scale.
The vulnerability that enabled this—treating initialization codes plus approved orders as functionally equivalent to full certificate issuance authority—is a common pattern in legacy systems: a convenience feature designed for support staff becomes a privilege escalation vector in the hands of attackers. The fact that DigiCert's support portal allowed this is less surprising than the fact that no other CA appears to have been breached this way, suggesting either better controls or simply better luck.
What should alarm defenders most is the timing and targeting precision. GoldenEyeDog didn't break into DigiCert randomly; they specifically targeted the customer support chat channel used by developers obtaining code-signing certificates. This implies reconnaissance, planning, and an understanding of the certificate issuance workflow—hallmarks of a group that has studied supply chain attack tactics used by state-sponsored actors and adapted them for criminal profit.
For the next 18 months, security teams must assume that malware signed with DigiCert certificates issued in April 2026 could be malicious, regardless of signature validity. More broadly, organizations need to abandon the assumption that code signatures equal trust. In a world where certificate authorities themselves can be compromised, cryptographic signatures are necessary but no longer sufficient. — HackWire Editorial
---
## Related Coverage