A code-signing certificate is supposed to mean something. It’s the digital equivalent of a notarized signature: this file came from who it says it came from, and nobody tampered with it on the way to your machine. That assumption just took a direct hit. Researchers have now attributed the April 2026 DigiCert breach to a subgroup of the Chinese threat cluster GoldenEyeDog, and the fallout is exactly what you’d expect when a certificate authority gets popped: stolen signing certificates that let malware walk past defenses dressed as something trustworthy. This is the kind of story that should worry every cybersecurity team more than another headline zero-day, because it doesn’t exploit a bug. It exploits your trust.

When The Signature Lies, Threat Detection Fails

Expel, the firm that dug into the DigiCert incident, tied the breach to a group it calls CylindricalCanine, a sub-group of GoldenEyeDog, also tracked as APT-Q-27 or Dragon Breath. This is a crew with a track record in the gambling and gaming sectors, and now it’s walked away with something far more valuable than a single victim’s data: the ability to sign malicious code with certificates that endpoint tools are configured to trust by default.

Here’s why that matters more than it sounds like it should. A huge chunk of modern threat detection, from application allowlisting to EDR heuristics to plain old SmartScreen-style reputation checks, leans on code signing as a shortcut. Signed binaries get less scrutiny. That’s not a flaw in the tools, it’s a deliberate design choice, because inspecting every executable from scratch doesn’t scale. Attackers know this, which is exactly why certificate theft keeps showing up as a goal, not a side effect, of major intrusions.

The practical result: a signed dropper from a compromised authority can sail through defenses tuned to flag unsigned or low-reputation files. Your firewall never sees it as a network anomaly because it looks like routine software delivery. Your endpoint agent doesn’t flag it because the signature checks out. The compromise happens entirely inside the trust boundary you built your defense in depth around.

The Supply Chain Just Grew Another Blind Spot

Certificates aren’t the only trust signal getting abused this week. Checkmarx researchers uncovered seven malicious npm packages targeting the Vite build tooling ecosystem, part of a campaign they’ve named ViteVenom. It’s an expansion of an earlier operation called ChainVeil, and the infrastructure behind it is not subtle.

Checkmarx describes ChainVeil’s command-and-control setup as a four-tier, blockchain-based infrastructure spanning Tron and other chains, calling the design “unprecedented” even before this latest expansion.

Using blockchain transactions to relay C2 instructions isn’t a gimmick. It’s resilient by design, since there’s no single domain or IP for defenders to sinkhole or block, and no registrar to serve a takedown notice to. The packages themselves ride on the same trust developers extend to any dependency pulled through a package manager: it’s on the registry, it has a plausible name, it must be fine.

Separately, SentinelOne’s latest roundup flags roughly 300 imposter GitHub repositories pushing an infostealer called BoryptGrab, dressed up to look like legitimate open-source projects. Add that to certificate theft and blockchain-backed npm malware and you get a pattern, not a coincidence: attackers are no longer trying to break your perimeter. They’re forging the credentials that let them walk through the front door you already trust.

• Code-signing certificates: stolen from a CA, used to make malware look verified
• npm packages: planted in a real ecosystem, backed by C2 infrastructure that’s hard to take down
• GitHub repositories: cloned and renamed to mimic legitimate projects developers already search for

Three different channels, one shared exploit: the assumption that a trust signal means the thing behind it is safe. That assumption is the actual attack surface here, and it doesn’t show up on a vulnerability scan.

Trusting Less Is Now A Security Hardening Requirement

None of this means giving up on code signing or package registries. It means stopping treating them as sufficient controls on their own. A few changes worth making now, not on your next roadmap cycle:

• Pull certificate revocation lists into your detection pipeline and alert on any signed binary tied to a certificate that gets revoked after execution, not just before
• Pin dependency versions and hashes for critical build tooling like Vite, rather than trusting whatever the latest tagged release happens to be
• Audit your npm and GitHub dependency graph for typosquats and imposter repos on a schedule, not just when someone stumbles onto one
• Treat signature validity as one signal among many for threat detection, and pair it with behavioral monitoring that flags what the code actually does at runtime
• Segment build and CI systems from production networks so a compromised dependency can’t pivot straight into deployment

This is also where incident response planning earns its keep. If a certificate your organization trusts gets revoked due to a breach like DigiCert’s, you need a fast way to find every binary signed with it inside your environment, not a scramble through change logs three weeks later. Build that query now, before you need it at 2 a.m.

There’s a broader thread here worth sitting with too. Dark Reading ran a piece this week arguing the real risk in AI-assisted operations isn’t the sophistication of the model, it’s blind trust in what it outputs when nobody’s checking its work. Swap “AI model” for “certificate authority” or “package registry” and the argument holds up just as well. Every layer of automation and delegation you add, whether it’s a signing chain or an autonomous agent, needs a human or a control checking behind it. Skip that step and you’re not doing cybersecurity, you’re doing faith-based IT.

WordPress admins have their own reminder of this same principle this week: version 7.0.2 patches a critical SQL injection and REST API route-confusion bug that leads straight to remote code execution. Patch it today. But patching alone is table stakes. The bigger lesson from this week’s stories is that trust itself, in certificates, in packages, in repos, needs the same scrutiny you’d give an unpatched server. Verify it, monitor it, and assume it will eventually be abused, because it already has been.

Sources

• GoldenEyeDog Subgroup Linked to DigiCert Breach and Code-Signing Certificate Theft
• Seven Malicious Vite npm Packages Use Blockchain C2 to Deliver a RAT
• The Good, the Bad and the Ugly in Cybersecurity – Week 29
• The Real AI Threat Is Blind Trust
• Two new high severity WordPress vulnerabilities, patch immediately!