Microsoft Defender Falsely Flags DigiCert Root Certificates

Microsoft Defender falsely flagged legitimate DigiCert root certificates as malware on Windows systems worldwide, prompting the antivirus software to quarantine or remove them from trust stores and disrupting security chains for numerous users and organizations.

The issue surfaced after a Microsoft Defender signature update released on April 30, which introduced detection logic for the threat labeled TrojanWin32Cerdigent.A!dha. Administrators reported that trusted DigiCert root certificates, such as DigiCert Assured ID Root CA and DigiCert Trusted Root G4, were incorrectly identified as malicious. On affected systems, the certificates were deleted from the Windows AuthRoot store, breaking trust relationships essential for validating websites, applications, and secure connections. This led to application failures, heightened alerts, and confusion among IT teams, with some responding as if facing genuine infections by rebuilding systems.

Microsoft attributed the detections to a recent security incident at DigiCert, a major certificate authority. Attackers compromised a support analyst's device in early April through a malicious ZIP file disguised as a screenshot, gaining limited...