DigiCert Hacked via Weaponized Screensaver File to Obtain EV Code Signing Certificates

**Executive summary:** A threat actor compromised DigiCert support analysts via a malicious .scr inside a ZIP delivered through a Salesforce chat, enabling theft and activation of 60 EV Code Signing certificates that were used to sign and distribute the Zhong Stealer malware; DigiCert revoked all affected certificates, identified seven attacker IPs, linked 27 certs to the attacker, and implemented UI/API fixes, stricter MFA controls, suspended analyst accounts, and canceled pending code-signing orders.