Loading story…
A faulty Microsoft Defender signature update released on April 30 incorrectly detected legitimate DigiCert root certificates as Trojan:Win32/Cerdigent.A!dha, triggering alerts across Windows environments and, in some cases, quarantining or removing trusted roots from stores such as AuthRoot. The flagged thumbprints were tied to valid DigiCert trust anchors, including DigiCert Assured ID Root CA and DigiCert Trusted Root G4, causing administrators and SOC teams to suspect compromise and disrupting certificate trust relationships used for TLS validation and code signing.
Microsoft later acknowledged the detections were erroneous and remediated the issue with updated Defender security intelligence, including version 1.449.430.0 or later. Reporting indicates the overly broad detection logic may have stemmed from Microsoft’s response to a separate DigiCert code-signing certificate incident linked to abuse such as the Zhong Stealer campaign, but the certificates flagged in this case were legitimate and not revoked. The false positive prompted some organizations to take unnecessary recovery actions, including system rebuilds, underscoring the operational risk of automated detections that affect root certificate trust stores.
See real exploitation activity before you spend the cycle.
3 events from the most recent confirmed update back to the earliest known activity.
Microsoft later corrected the erroneous detection logic and advised use of Security Intelligence version 1.449.430.0 or later. The update stopped legitimate DigiCert root certificates from being misidentified as malware.
On 2026-05-03, Windows administrators and SOC analysts began reporting repeated Defender detections for Trojan:Win32/Cerdigent.A!dha affecting legitimate DigiCert root certificates. On some systems, Defender quarantined or removed trusted certificates from stores such as AuthRoot, disrupting trust relationships and prompting incident response actions.
A Microsoft Defender security intelligence update released on 2026-04-30 introduced detection logic that incorrectly flagged legitimate DigiCert root certificates as Trojan:Win32/Cerdigent.A!dha. The faulty logic was reportedly tied to Microsoft's response to a DigiCert-related code-signing certificate security incident.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcetechrepublic.com
Open sourcecensys.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
DigiCert disclosed a breach in which a threat actor socially engineered its support team with a malicious ZIP file disguised as a customer screenshot, compromising two analyst workstations and gaining access to initialization codes for previously approved but undelivered EV code-signing certificate orders. The attacker used that access to obtain legitimate trusted code-signing certificates, and DigiCert revoked 60 certificates in response, including 27 directly linked to the intrusion. Reporting indicates 11 of those certificates were already used in the wild to sign **Zhong Stealer** malware, while a misconfigured CrowdStrike EDR agent on one compromised machine helped the attacker remain undetected for nearly two weeks. The incident unfolded alongside a separate trust-related disruption affecting DigiCert certificates on Windows systems: a faulty Microsoft Defender signature update released around April 30 falsely detected the legitimate **DigiCert Assured ID Root CA** and **DigiCert Trusted Root G4** certificates as `Trojan:Win32/Cerdigent.A!dha`. On affected hosts, Defender quarantined registry entries from the Windows trust store, raising the risk of SSL/TLS validation failures, broken code-signing verification, browser warnings, and enterprise application outages. Microsoft acknowledged the false positives and issued corrected definitions, with version `.430` cited as restoring the removed certificates automatically, while DigiCert tightened controls by enforcing MFA on administrative workflows, restricting access to initialization codes, limiting attachment types in support channels, and improving logging.
Jul 20, 2026
Microsoft has confirmed a Microsoft Defender Antivirus defect that falsely warns Windows users that virus protection is turned off even when Defender and real-time protection remain enabled and functioning. The recurring “Turn on virus protection” notifications can appear at startup or intermittently afterward, including after they are dismissed, and may bypass Windows notification controls and Do Not Disturb settings. The issue affects supported Windows client and server releases, with reports spanning Windows 10 and Windows 11 versions through 26H1, as well as Windows Server 2025. Microsoft advises users to ignore the erroneous alerts while it develops a correction to be distributed in a future Defender Antivirus update; organizations should nevertheless verify Defender’s actual protection status, as genuine security warnings and social-engineering imitations remain possible.
Sep 1, 2026
A newly disclosed Microsoft Defender vulnerability tracked as **CVE-2026-50656** and dubbed **RoguePlanet** allows a low-privileged attacker to gain **SYSTEM** privileges by exploiting a time-of-check/time-of-use (**TOCTOU**) race condition in the Microsoft Malware Protection Engine’s remediation workflow. According to public reporting, the issue lies in Defender’s quarantine and remediation process, turning the security product itself into an attack surface that can be abused during malware handling. Public detection content has already begun to appear, including a **Nuclei** template proposal designed to identify signs of exploitation through suspicious quarantine artifacts and remediation logs. The template references the Morphisec disclosure and describes checks intended to help defenders spot abuse of the quarantine mechanism, giving security teams an early way to hunt for potential exploitation while assessing exposure to the Microsoft Defender privilege-escalation flaw.
Jul 22, 2026