DigiCert Code Signing Misissuance Leads to Defender False Positives on Root Certificates

Du'aine Davis

Observed in the wild

• In early April, DigiCert was breached via its support function, enabling attackers to obtain and misuse EV code‑signing certificates; 60 certificates were later revoked. This activity led Microsoft Defender, on 30 April 2026, to incorrectly flag legitimate DigiCert root certificates as malware, removing them from Windows trust stores and causing widespread false positives across enterprise environments.
• A threat actor targeted DigiCert support staff using social engineering, delivering a malicious ZIP disguised as a customer screenshot via chat, eventually compromising analyst endpoints. The attacker exploited gaps in EDR coverage and leveraged internal support portal access to extract “initialisation codes”, enabling issuance of valid code‑signing certificates later used to sign malware.
• Organisations are advised to update Microsoft Defender signatures to version 1.449.430.0 or later to suppress false positives and restore removed certificates. Administrators should verify certificate integrity in Windows trust stores, monitor Defender detections for anomalous certificate removal, and hunt for signed malware binaries exhibiting unusual trust chains or newly issued certificates linked to legitimate vendors.

2033170 - DigiCert: Misissued code signing certificates
Microsoft Defender wrongly flags DigiCert certs as Trojan:Win32/Cerdigent.A!dha