Microsoft Defender briefly did flag legitimate DigiCert

 Microsoft Defender briefly did flag legitimate DigiCert root certificates as malware, but it was a false positive caused by a faulty Defender signature update, not an actual compromise of those certificates.

A Microsoft Defender security‑intelligence update released on April 30, 2026 introduced a detection labeled Trojan:Win32/Cerdigent.A!dha. That detection mistakenly matched the thumbprints of two long‑trusted DigiCert root certificates:

• 0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43

• DDFB16CD4931C973A2037D3FC83A4D7D775D05E4

Defender treated these certificates as malware and, on many systems, removed them from the Windows AuthRoot trust store, triggering:

• Broken HTTPS validation

• Code‑signing failures

• Application authentication errors

• Enterprise service disruptions

This led many admins to believe they were facing a real compromise.

Why Defender flagged them

Microsoft added new detection logic after reports of compromised DigiCert code‑signing certificates used in malware campaigns (e.g., Zhong Stealer). The detection was intended to catch malicious certificates — but the signature logic was overly broad and matched legitimate root CAs.

Importantly:

• DigiCert root certificates were not compromised.

• The issue was entirely a Defender false positive, not a breach of DigiCert’s trust infrastructure.

Microsoft’s fix

Microsoft corrected the detection in Security Intelligence update 1.449.430.0 (and later). The fix:

• Stops the false alerts

• Automatically restores any removed DigiCert certificates

No further action is required beyond ensuring Defender is up to date.

What you should do (quick checklist)

• Force a Defender update Windows Security → Virus & threat protection → Protection updates → Check for updates

• Verify DigiCert roots are present (optional)

  PS C:\Users\glang> certutil -store AuthRoot | findstr -i digicert

• Do NOT rebuild systems — this was not an infection.

Bottom line

This was a global Defender false positive, not a malware outbreak or DigiCert compromise. Updating Defender fully resolves the issue and restores trust store entries.

If you want, I can also provide a post‑incident validation checklist for enterprise environments to ensure no lingering certificate or trust‑chain issues remain.