Microsoft Defender’s False Alarm: How a Flawed Signature Flagged Trusted DigiCert Certificates as Malware

What Is Trojan:Win32/Cerdigent.A!dha?

Starting on the morning of May 3, 2026, Windows users around the world began waking up to urgent security warnings from Microsoft Defender. The alert named a high-severity Trojan: Trojan:Win32/Cerdigent.A!dha. The wave of near-simultaneous reports across continents immediately raised a crucial question: was this a genuine mass infection, or something else entirely?

Security researchers quickly determined it was the latter. The Cerdigent detection is real — it was introduced by Microsoft to flag malicious certificates linked to a DigiCert breach — but its signature was written too broadly. Instead of targeting only the compromised certificates it was designed to catch, it swept up two widely-trusted, entirely legitimate DigiCert root CA certificates used by countless websites, software, and enterprise services worldwide.

Adding to the confusion, Defender did not simply warn users — it acted. On many affected systems, it automatically quarantined and deleted the flagged certificate registry entries, quietly removing trusted root certificates from the Windows certificate store without user confirmation.

The Background: A DigiCert Breach Sets the Stage

The story begins weeks earlier. According to a detailed incident report published in Mozilla’s Bugzilla tracking system, a threat actor gained limited access to DigiCert’s internal support systems after compromising a support analyst’s machine. Using this access, the attacker obtained initialization codes for a limited number of code-signing certificates — enough to generate certificates that appeared legitimate and were accepted by operating systems as trusted.

DigiCert investigated the breach between April 14–17, 2026, and identified 60 certificates that were potentially compromised. Of these, 27 were explicitly linked to the threat actor — 11 identified through community-reported malware samples, and 16 discovered during DigiCert’s own internal investigation. The remaining 33 were revoked as a precautionary measure. Several of the confirmed malicious certificates had been used to sign the Zhong stealer malware.

Microsoft responded by creating a new Defender signature, Trojan:Win32/Cerdigent.A!dha, to detect and block these compromised certificates. The intent was sound. The execution, however, went wrong.

What the Flawed Signature Actually Did

The Cerdigent signature was deployed in Defender Security Intelligence update 1.449.424.0 on April 30, 2026. Rather than matching only the certificate thumbprints associated with the DigiCert breach, it also matched the cryptographic thumbprints of two legitimate, long-established DigiCert root CA certificates that are part of the standard Windows trusted root store:

These certificates reside in the Windows registry under HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates, the system’s trusted root certificate store. When Defender flagged them, it deleted the corresponding registry keys as part of its standard remediation — effectively telling Windows to stop trusting those certificate authorities.

The real-world consequences of having these certificates removed can include broken HTTPS connections, failures in Windows Update, TLS errors in enterprise applications, and software refusing to launch because its signing chain can no longer be verified.

A Timeline of Events

Microsoft’s Response

After initially providing only automated community responses, Microsoft confirmed the nature of the false positive in an official statement:

Microsoft moved swiftly once the scope of the problem became clear. The corrected signature update began rolling out automatically across managed endpoints, with the fix also designed to restore any DigiCert root certificates that had been removed by the erroneous earlier update. Reports from administrators confirmed that certificate restoration was occurring automatically.

The current latest Defender definition version is ✓ 1.449.431.0, which includes the fix and certificate restoration.

How to Fix It: Step-by-Step

If the alert persists after updating, reboot your machine and run the definition update check again. Automatic restoration of certificates may take a short time to propagate across all affected systems.

What Not to Do

• Do not reinstall Windows. Testing confirms a fresh Windows 11 install with no third-party software triggers the same alert when running the affected signature version. Reinstalling solves nothing and wastes time.
• Do not manually delete the flagged files. The “infected” objects are legitimate root certificate registry entries. Deleting them intentionally will break HTTPS and other certificate-dependent functionality on your system.
• Do not modify your root certificate store manually. Incorrect changes to HKLM\SOFTWARE\Microsoft\SystemCertificates can cause irreversible system failures. Let Defender’s update handle the restoration.
• Do not disable Defender long-term. Temporarily pausing real-time protection may stop the alert noise while waiting for the update, but disable it for the shortest time possible and re-enable it immediately after updating.
• Do not pay for “removal tools.” Some websites are exploiting this incident to sell unnecessary antimalware software. The legitimate fix is free via Windows Update.

The Broader Lesson

The Cerdigent incident is a reminder of how closely interconnected modern software trust infrastructure really is. A single signature update — one that was genuinely motivated by a real threat — rippled outward to affect hundreds of millions of Windows systems worldwide. The speed with which Microsoft identified and patched the issue is commendable, but the episode underscores the need for rigorous quality controls around signature releases, particularly for detections that touch foundational OS components like the root certificate trust store.

For enterprises, the incident also highlights the importance of monitoring certificate store integrity as part of endpoint health checks. Cybersecurity researcher Florian Roth suggested the following quick diagnostic query for administrators managing fleets of Windows machines:

The Windows certificate trust chain underpins a vast swath of the internet’s security model. When that chain is disturbed — even accidentally — the effects are immediate and global. As the world’s most widely deployed desktop operating system, Windows carries a responsibility commensurate with its reach. This incident, ultimately resolved within hours, is a case study in both the fragility and the resilience of modern security infrastructure.