A breach of DigiCert’s customer support environment in early April 2026 allowed a Chinese APT-linked threat actor to obtain EV code-signing certificates, which were used to sign malware payloads in a campaign called Zhong Stealer. A separate incident occurred on April 30, 2026, when a Microsoft Defender signature update incorrectly flagged legitimate DigiCert root certificates as malware, removing them from enterprise trust stores and causing widespread operational disruption. Organizations relying on EV-signed software for trust verification and Windows endpoints running Defender are exposed to both malware infiltration risk and self-inflicted availability loss from the defensive overreach.