--- title: Microsoft Defender wrongly flags DigiCert certs as... description: Microsoft Defender began incorrectly flagging legitimate DigiCert root certificates as Trojan:Win32/Cerdigent.A!dha following a signature update on April 30th.... canonical: https://daily.dev/posts/microsoft-defender-wrongly-flags-digicert-certs-as-trojan-win32-cerdigent-a-dha-upyvku4z0 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Microsoft Defender wrongly flags DigiCert certs as Trojan:Win32/Cerdigent.A!dha | daily.dev og:description: Microsoft Defender began incorrectly flagging legitimate DigiCert root certificates as Trojan:Win32/Cerdigent.A!dha following a signature update on April 30th.... og:url: https://daily.dev/posts/microsoft-defender-wrongly-flags-digicert-certs-as-trojan-win32-cerdigent-a-dha-upyvku4z0 og:image: https://api.daily.dev/og/posts/Upyvku4Z0.png og:image:alt: Microsoft Defender wrongly flags DigiCert certs as Trojan:Win32/Cerdigent.A!dha og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Microsoft Defender wrongly flags DigiCert certs as Trojan:Win32/Cerdigent.A!dha **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 5 min read · 0 upvotes · 0 comments ## Summary Microsoft Defender began incorrectly flagging legitimate DigiCert root certificates as Trojan:Win32/Cerdigent.A!dha following a signature update on April 30th. The false positives caused widespread alerts and, on some systems, removed the certificates from the Windows trust store, prompting some users to reinstall Windows. Microsoft has since released a fix in Security Intelligence update 1.449.430.0 that also restores removed certificates. The incident may be connected to a DigiCert security breach in which attackers compromised a support team member, obtained EV code-signing initialization codes, and used them to sign malware — including a campaign attributed to Chinese threat group GoldenEyeDog using certificates fraudulently issued to companies like Lenovo and Kingston. DigiCert revoked 60 certificates, 27 linked to the 'Zhong Stealer' malware campaign. However, the root certificates flagged by Defender do not match the revoked code-signing certificates. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Counterfeit installers turn routine software downloads into enterprise breaches](https://daily.dev/posts/counterfeit-installers-turn-routine-software-downloads-into-enterprise-breaches-mezthho2a) · CSO Online · 0 upvotes · 0 comments - [Microsoft warns of new Defender zero-days exploited in attacks](https://daily.dev/posts/microsoft-warns-of-new-defender-zero-days-exploited-in-attacks-0yj5px1ug) · BleepingComputer · 0 upvotes · 0 comments - [Windows 11's driver signature requirement is one of the best anti-consumer security features out there](https://daily.dev/posts/windows-11-s-driver-signature-requirement-is-one-of-the-best-anti-consumer-security-features-out-the-peze2jn3v) · XDA Developers · 0 upvotes · 0 comments - ['BigDiskBuster' Leaves Microsoft Defender Running, Blocks Updates](https://daily.dev/posts/bigdiskbuster-leaves-microsoft-defender-running-blocks-updates-sf4giyv3r) · Dark Reading · 0 upvotes · 0 comments --- Tags: [#malware](https://daily.dev/tags/malware), [#security](https://daily.dev/tags/security) [View this post on daily.dev](https://daily.dev/posts/microsoft-defender-wrongly-flags-digicert-certs-as-trojan-win32-cerdigent-a-dha-upyvku4z0) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Microsoft Defender wrongly flags DigiCert certs as Trojan:Win32/Cerdigent.A!dha","url":"https://daily.dev/posts/microsoft-defender-wrongly-flags-digicert-certs-as-trojan-win32-cerdigent-a-dha-upyvku4z0","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/microsoft-defender-wrongly-flags-digicert-certs-as-trojan-win32-cerdigent-a-dha-upyvku4z0"},"datePublished":"2026-05-03T18:13:42.022Z","dateModified":"2026-10-15T02:14:30.302Z","description":"Microsoft Defender began incorrectly flagging legitimate DigiCert root certificates as Trojan:Win32/Cerdigent.A!dha following a signature update on April 30th....","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ca8259f3812445c0051b7a4df0715279?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ca8259f3812445c0051b7a4df0715279?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/microsoft-defender-wrongly-flags-digicert-certs-as-trojan-win32-cerdigent-a-dha-upyvku4z0","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"malware,security","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"Microsoft Defender wrongly flags DigiCert certs as Trojan:Win32/Cerdigent.A!dha"}]} ```