Trending Now - Microsoft Defender's False Positive Causes Widespread Certificate Issues

WHO:

LinkedIn - Microsoft Defender, DigiCert, cybersecurity community, system administrators, IT professionals, users, Florian Roth, threat group "GoldenEyeDog" (APT-Q-27).

BleepingComputer - Cybersecurity researchers including Squiblydoo, MalwareHunterTeam, and g0njxa.

WHAT:

LinkedIn - Microsoft Defender mistakenly identified legitimate DigiCert digital certificates as malicious software, specifically labeling them as Trojan:Win32/Cerdigent.A!dha.

LinkedIn - The error led to the automatic removal of critical certificates from Windows systems.

LinkedIn - Two specific certificate thumbprints were reported: 0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 and DDFB16CD4931C973A2037D3FC83A4D7D775D05E4.

LinkedIn - Microsoft released updated Defender signatures in Security Intelligence version 1.449.430.0 and version 1.449.431.0 to address the issue.

BleepingComputer - Microsoft Defender's false positives led some users to believe their devices were infected, prompting full operating system reinstalls.

WHERE:

LinkedIn - The issue affected enterprise environments, managed networks, and individual users globally.

LinkedIn - The certificates were removed from the Windows trust store located at HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\.

WHEN:

LinkedIn - The issue first emerged following a security intelligence update on April 30.

LinkedIn - DigiCert's security breach began in early April.

WHY:

LinkedIn - The false positives were linked to a recent security breach at DigiCert, where attackers targeted internal support systems and obtained initialization codes for code-signing certificates.

BleepingComputer - The breach allowed attackers to procure initialization codes for a limited number of code-signing certificates, which were then used to sign malware.

HOW:

LinkedIn - Attackers used phishing attempts involving malicious ZIP files disguised as screenshots to compromise DigiCert's support staff.

LinkedIn - The malware campaign involved the use of valid certificates to bypass security warnings, with the malware named "Zhong Stealer" functioning as a remote access trojan (RAT).

(UPDATED May 4, 2026 17:26 UTC)

Microsoft Defender mistakenly flagged legitimate DigiCert digital certificates as malicious software, resulting in their automatic removal from Windows systems and causing confusion among users who believed their devices were infected. This issue, which emerged after a security intelligence update on April 30, was linked to a security breach at DigiCert, where attackers acquired initialization codes for code-signing certificates through phishing attempts. In response, Microsoft released updated Defender signatures to address the false positives, impacting enterprise environments and individual users worldwide.