Notifications
Clear all
Topic starter
18/08/2026 2:33 pm
TL;DR: GoldenEyeDog has used code-signing certificates to bypass Windows SmartScreen and, in April 2026, leveraged a DigiCert intrusion to steal customer certificates and sign malware, according to Expel. The pattern shows how certificate lifecycle failures and support-channel compromise can turn trusted issuance into an attack path, not just a control.
NHIMG editorial — based on content published by Expel: GoldenEyeDog malware, DigiCert certificate theft, and Golden Gh0st RAT analysis
By the numbers:
- 69% of organisations now have more machine identities than human ones.
- 57% of organisations lack a complete inventory of their machine identities.
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures.
Questions worth separating out
Q: What breaks when code-signing certificates are resold or reused by attackers?
A: Trusted execution breaks down because defenders and operating systems may treat malicious files as legitimate software.
Q: Why do code-signing certificates create governance risk beyond software publishing?
A: Because they are identity credentials for software, code-signing certificates sit inside a lifecycle that includes issuance, activation, custody, renewal, and revocation.
Q: How do security teams detect certificate abuse in real environments?
A: Teams should look for unexpected signed binaries, unusual publisher lineage, companion DLL loading, and malware that appears only after trusted execution paths are used.
Practitioner guidance
- Inventory code-signing certificates as NHI assets Track issuers, owners, renewal dates, token custody, and downstream software use in a single certificate register so support teams cannot act outside visible governance.
- Lock down support-channel delivery paths Quarantine attachments and linked downloads that reach support queues, and require detonation or sandbox review before a ticketed file can be executed on a support device.
- Separate certificate activation codes from support endpoints Move initialization codes and token activation material out of general-purpose support laptops and require privileged approval for any retrieval or use.
What's in the full article
Expel's full analysis covers the technical detail this post intentionally leaves at the governance and risk level:
- Malware unpacking details for Golden Gh0st Loader and Golden Gh0st RAT, including the staged DLL sideloading chain
- Network communication decryption logic and indicator examples that support hands-on detection work
- Observed command IDs, plugin behavior, and persistence mechanisms used by the implant
- IOC tables and campaign artifacts that help defenders correlate related activity across environments
👉 Read Expel’s analysis of GoldenEyeDog malware and DigiCert certificate theft →
Code-signing certificate theft and SmartScreen bypass: what teams missed?
Explore further
18/08/2026 3:20 pm
Certificate trust is an identity control, not a branding problem. When attackers can sign malware with legitimate certificates, they are abusing a software identity that downstream controls are built to trust. That means certificate governance must be treated with the same seriousness as privileged access, because the blast radius includes execution trust across endpoints and application controls. Practitioners should manage certificates as high-value identities, not as passive technical artifacts.
A few things that frame the scale:
- 69% of organisations now have more machine identities than human ones, according to The Critical Gaps in Machine Identity Management report.
- 57% of organisations lack a complete inventory of their machine identities, which makes certificate and workload governance harder to sustain at scale.
A question worth separating out:
Q: Who is accountable if a certificate is misused in an approval workflow?
A: Accountability sits with both the issuing authority and the organisation operating the workflow. The issuer must validate certificate governance, while the department must control role assignment, key custody, and revocation. In regulated environments, that shared accountability is what makes the audit trail defensible.
👉 Read our full editorial: GoldenEyeDog’s DigiCert certificate theft exposes NHI trust gaps
