Defender mislabels DigiCert roots as malware, prompting trust-store removals
Microsoft Defender’s signature update incorrectly flagged legitimate DigiCert root certificates in the Windows AuthRoot store as Trojan:Win32/Cerdigent.A!dha, leading to removals; Microsoft fixed the false positives in Security Intelligence updates 1.449.430.0 and 1.449.431.0, with automatic updates rolling out and manual checks available. The DigiCert breach is being discussed as a possible link, though the Defender flags target root certificates rather than the revoked EV code-signing certificates linked to DigiCert’s incident.