DigiCert Security Breach Linked to GoldenEyeDog Certificate Hijacking Campaign

DigiCert’s April 2026 security incident has been linked to a GoldenEyeDog subgroup tracked as CylindricalCanine, which allegedly used malware to compromise a support employee’s device and intercept code-signing certificate activation data.

The attackers then used stolen certificates to sign malware, giving malicious files a greater appearance of legitimacy.

The campaign reportedly began with a phishing lure disguised as a screenshot or document sent through DigiCert’s support-ticket workflow.

When a support employee downloaded and opened the malicious file, the Golden Gh0st Loader malware infected the device.

The intrusion granted the threat actors access to initialization codes for customers renewing code-signing certificates. Those codes are used to activate customers’ physical signing tokens.

By intercepting them, the attackers could obtain certificates intended for legitimate customers and use them to sign their own malware digitally.

GoldenEyeDog has reportedly abused code-signing certificates since at least 2024 to reduce SmartScreen warnings and improve the success rate of malicious EXE and MSI files.

Certificate reputation controls can still flag newly signed files. However, a valid signature may make malware appear more trustworthy to users and some security tools.

GoldenEyeDog Hijacks DigiCert Certificates

Researchers believe CylindricalCanine is a distinct operational subgroup within the broader China-linked GoldenEyeDog activity cluster, also tracked by Qi’anxin as APT-Q-27.

The group has targeted financial organizations in the Asia-Pacific region and has used phishing, malicious support submissions, credential theft, and modular malware delivery.

The malware chain relies on DLL sideloading. A first-stage loader downloads a legitimate executable, a malicious DLL, and an encrypted payload disguised as a log file.

The legitimate program loads the rogue DLL, which decrypts the payload in memory and launches Golden Gh0st RAT. Golden Gh0st RAT is a modified remote-access trojan based on the older Gh0st RAT family.

It provides operators with extensive control over compromised systems, including screenshot capture, keylogging, process discovery, command execution, proxy tunneling, browser credential theft, file deletion, event-log clearing, and persistence, expel said.

The RAT can also collect data from Chrome, Firefox, Skype, Tencent QQ Browser, and the Chinese 360 browser.

In some observed samples, it can deploy an additional persistence plugin that creates a privileged backdoor account and modifies Windows logon settings to support remote access.

For command-and-control communications, the malware uses unencrypted WebSocket connections with custom encrypted payloads, often over ports 5188 and 5198.

Reported infrastructure includes uu.goldeyeuu.io:5188, wk.goldeyeuu.io:5188, and api.keensie.com:5198.

Indicators of Compromise

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Prevent critical incidents and financial loss with stronger proactive defense. Integrate a live threat feed from 15K SOCs