Valid DigiCert Cert Turns 2345 SafeCenter Update Channel Into Malware Pipeline

Seventeen Windows PE files posing as 2345 SafeCenter and HaoZip components carry a still-valid DigiCert code-signing certificate that suppresses SmartScreen warnings and fools automated sandboxes. One component matches an ESET YARA rule for SQL Server authentication bypass, raising the threat classification well above commodity adware. The campaign was still signing new builds as of 2026-05-29.