What to do when malware adds a fake security certificate

When malware adds a fake security certificate to your browser's trusted store, it may be installing an unauthorised root certificate that lets attacker-controlled sites pass HTTPS checks. The browser may show a certificate warning, but some infections redirect traffic through a local proxy and leave no obvious alert. Treat unexpected trust changes as malware until verified, not as a nuisance to bypass.

Start by disconnecting the affected computer from the internet and avoid online banking, email, mygov and other sign-ins. Use a separate clean device to change important passwords after cleanup. Record the affected browser, site address, certificate issuer and error message, because those details identify which certificate store and removal method you need.

How a forged trust anchor causes the problem

A root certificate is a trust anchor: once installed, systems signed by its private key can be treated as valid. Malware can use that authority with a local proxy to decrypt or alter traffic. A padlock only shows that traffic was encrypted to a certificate the device trusts; it does not prove the destination is genuine.

Look for warning names such as “certificate authority invalid,” an issuer not seen before, a changed homepage, strange traffic to unfamiliar addresses, or new browser extensions and profiles. These clues often appear together. A hijacked search engine or altered shortcuts may be part of the same compromise, so removing one certificate alone may leave other persistence behind.

Confirm the warning before changing anything

Capture the full error and inspect the certificate chain. Record the issuer, validity dates and SHA-256 fingerprint; do not rely on the issuer's display name, which malware can imitate. Compare that fingerprint with the certificate authority's official published details. If the warning occurs only on a work or school device, ask the Australian organisation's IT team before changing trust settings.

Australian users should be cautious around mygov, the Australian Taxation Office, banks such as CBA, Westpac, ANZ and NAB, and major email providers. Legitimate services will not ask you to ignore a certificate warning or install a root certificate over the phone. Calls claiming to be Telstra or Optus support are a known impersonation pattern; if a caller suggests importing a certificate, end the call independently. Scamwatch and the Australian Cyber Security Centre provide guidance on these scams.

Remove the certificate from the correct store

On Windows, open certmgr.msc, select Trusted Root Certification Authorities, and inspect the root that matches the recorded fingerprint. Delete only the confirmed malicious certificate, then review similarly named entries without bulk-removing roots. Chrome and Edge normally rely on the Windows certificate store, but extensions, shortcuts and scheduled tasks can reinstall the certificate or alter browser settings after deletion.

Firefox maintains its own certificate authorities in Settings, Privacy & Security, then Certificates and View Certificates. Confirm the suspicious entry in the Authorities view before removing it. On a Mac, check Keychain Access, especially the login keychain, and the certificate trust settings available in current macOS releases. Do not remove a root merely because it appears under System Roots; verify its fingerprint and seek technical help with a system-level entry.

After removal, fully quit every browser and restart it. If the warning returns, the infection is active again or another certificate is being installed. Run Microsoft Defender Offline or another reputable offline-capable scanner, then repeat the certificate checks. If fake trust was active during banking or email use, revoke active sessions and rotate those credentials from a known-clean device.

Clean up related browser tampering

Removing a forged root addresses the trust problem, but it does not remove the malware that installed it. Review browser extensions, managed policy notices, homepage and search-engine settings, startup programs, and Task Scheduler entries on Windows or login items on macOS. Removing unexpected programs requires administrator approval, so use a standard account where possible and keep a record of what you changed.

If search results or the homepage remain redirected, search hijacker cleanup explains how adware overrides browser search settings. If the malware also hid desktop icons, hidden desktop icons covers that separate persistence trick. Clean the browser and operating system in parallel, then reopen the affected site only after confirming that its certificate chain is expected.

Compare responses by device and browser

The correct response depends on where the unauthorised root was placed and whether policy manages the device.

Situation	Likely certificate location	Sensible first response
Windows with Chrome or Edge	Trusted Root Certification Authorities in Windows	Match the fingerprint, remove that root and scan for installers
Firefox on any desktop	Firefox Authorities store	Remove the confirmed root and inspect extensions
macOS with Safari or Chromium	Login Keychain or macOS trust settings	Verify the fingerprint, delete the user-added root and rescan
Employer- or school-managed device	Organisational policy may protect or add roots	Ask IT to inspect it and rotate any exposed credentials

Different stores mean that deleting a certificate in one place may not affect another. If several browsers show the same interception, assume the operating-system trust store is involved and seek technical assistance rather than deleting certificates at random.

Contain the incident and confirm recovery

Begin with these urgent steps:

• Disconnect the device from Wi-Fi or Ethernet, but do not power it off if active traffic capture is suspected.
• Save the warning details, affected addresses and certificate fingerprint for verification.
• Update the browser and operating system through official channels after the malware scan.
• Run a reputable offline scan and inspect startup items before reconnecting.

Then complete these recovery checks:

• Remove only the certificate whose fingerprint and issuer details have been independently confirmed.
• Confirm that affected sites show the expected issuer and certificate chain.
• Change passwords from a clean device and sign out of banking, email and cloud accounts.
• Recheck the browser, extensions and homepage after a restart to detect reinfection.

The goal is to remove the unauthorised trust anchor, eliminate its installer and restore a browser that can be trusted. Keep evidence of the warning and scan results if the incident affected an Australian business or government account, as it may be needed for reporting and recovery.