SmartScreen publisher reputation dropped - all files signed with the same certificate affected simultaneously

Question

SmartScreen publisher reputation dropped - all files signed with the same certificate affected simultaneously

Oleksii 0

I am an independent software developer. I have been signing and distributing Windows software under the same publisher identity (Oleksii Surkis, Kyiv, Ukraine) since the early 2000s, with no incidents.

Download URL where the warning appears: https://www.neodownloader.com/download/NeoDownloaderSetup.msi

On 28 May 2026 I released a new build, signed it and downloaded it myself to verify - and found the SmartScreen "unrecognized app" warning. Checking further, I discovered that every file signed with my certificate was affected, including installers released in 2025 that had been downloading cleanly for months, with no changes to the files themselves. The drop may have occurred somewhat earlier; 28 May is simply when I noticed it, as that was the first time in a while that I had reason to check.

Nothing changed on my side:

same certificate, same thumbprint (no renewal, no re-issue)
same publisher details in the Subject
same download domain, unchanged for years

Certificate status:

Issued by Certum Code Signing 2021 CA, valid until 2028-02-20
Not revoked (OCSP: good, CA portal: Active, serial not present in the current CRL)
Signature timestamped; signtool verify /pa /v passes with 0 errors and 0 warnings

File status:

- VirusTotal: 0/70 and 0/58 on the main executable and the installer
- The WDSI portal itself reports "No malware detected" for both Cloud and Client

Because older, previously clean builds were affected as well as the new one, this looks like a publisher-level reputation drop rather than a per-file issue. My best guess is a false positive at some point before that; no detection is reproducible anywhere now.

Since then there has been partial recovery - some older builds no longer trigger the warning - but current builds still do, two months later.

I have submitted the installer through the Security Intelligence portal as a Software Developer, selecting Microsoft Defender SmartScreen as the product, and included the exact download URL. The automated scan has already returned "No malware detected" for both Cloud and Client (definitions 1.455.404.0); final determination is still pending.

Questions:

Is there any way to have publisher reputation reviewed when it drops due to a suspected false positive, rather than waiting for it to rebuild organically?
Is the WDSI submission the correct and only channel for an independent developer without an Azure subscription, or is there another path?

Happy to provide the submission ID, certificate thumbprint or any other details privately if an engineer needs them.

0 comments

1 answer

Your answer

Answer 1

Konstantinos Lianos 665 Student Ambassador

Hello @Oleksii ,

You have already followed the correct process. SmartScreen evaluates both the reputation of the individual file hash and the signing certificate/publisher. Therefore, a valid signature and a clean malware scan do not automatically prevent the “unrecognized app” warning. Since unchanged older builds were also affected, it is reasonable to suspect a certificate or publisher-reputation issue, although only Microsoft can confirm this

There is currently no public self-service process to reset publisher reputation or add a developer to a trusted publisher list. Microsoft specifically states that it does not accept requests for a known-list or false-positive-prevention program.

The Microsoft Security Intelligence submission portal is the correct channel, and an Azure subscription is not required. The file should be submitted as a Software developer, with Microsoft Defender SmartScreen selected, exactly as you have done. The initial “No malware detected” result does not necessarily resolve the SmartScreen reputation warning because SmartScreen reputation is separate from Defender Antivirus detection.

The next step is to wait for the final determination. If the warning remains or the final response does not address the wider publisher-level issue, use the developer contact form included with the submission results to request further investigation. Microsoft identifies this as the escalation path when a developer is not satisfied with the final determination

When escalating, include the submission ID, certificate thumbprint and serial number, SHA-256 hashes for the current installer and at least one previously trusted older build, the exact download URL, and the dates when the change was observed. It would also help to state clearly that multiple unchanged files signed with the same certificate were affected at approximately the same time.

Oleksii 0 Reputation points

2026-07-31T08:14:34.76+00:00
Thank you - that is helpful.

One problem with the escalation path: there is no final determination in my case. My previous submission in May stayed in "Pending" / "In progress" for a month and was then automatically removed from the portal without any final determination ever being issued. The current one is heading the same way - the analyst comment arrived, but the status has not moved past "In progress", and there is no reply field within the submission.

So the developer contact form that comes with the submission results is not reachable, because the results never finalise.

The analyst response I received was generic and described the "reputation not yet established" scenario. Notably it also says: "This reputation may be based on the downloaded program or can also be assigned to the publisher, based on digital certificate information. Once your signing certificate has gained reputation in our system, all applications or releases signed with your certificate should have warn-free experience (assuming nothing happens to denigrate the reputation of the certificate...)".

That second scenario is exactly mine: the certificate had established publisher reputation for over a year, and then something denigrated it - old unmodified builds and new ones started warning at the same time.

Is there another way to reach that form or to request further investigation when a submission expires without a final determination? Alternatively, is there an address or form for developer escalation that does not depend on a completed submission?

Meanwhile, for the record, here is the evidence pattern you asked about:

multiple unchanged files signed with the same certificate were affected at approximately the same time, including builds released in 2025 that had been downloading warn-free for months

since then, some of those older builds have stopped triggering the warning again, while current builds still do - consistent with a publisher-level signal that dropped and is slowly recovering

certificate: unchanged throughout, no renewal or re-issue, valid until 2028
Konstantinos Lianos 665 Reputation points Student Ambassador

2026-07-31T08:28:18.9833333+00:00

In this situation, the normal developer escalation process is effectively blocked because Microsoft’s documentation assumes that every submission eventually receives a final determination. It does not document what to do when a submission remains In progress and disappears before the developer contact form becomes available. The submission portal also states that submission details may only be retained for up to 30 days, which may explain why the older case disappeared.

The WDSI portal does provide a separate Contact WD Response option specifically for special requests and submission follow-ups. It can be accessed after signing in and does not appear to depend on the submission reaching a final status. However, access may be restricted for some accounts because the same section is described as part of Microsoft’s Defender Response process.

Therefore, the recommended next step is could be:

Sign in using the same Microsoft account used for the submissions.

Open the Contact WD Response escalation page.

Reference both the expired May submission and the current submission.

Explain that neither submission reached a final determination and that the developer contact form was therefore never made available.

The escalation should include:

Both submission IDs

Certificate thumbprint and serial number

SHA-256 hashes for a current build and an unchanged 2025 build

The exact download URL

The date the reputation change was first observed

Screenshots showing the submissions remaining In progress

Confirmation that the certificate is unchanged, valid and not revoked

The fact that older, previously warn-free files were affected at the same time

The evidence does support requesting a publisher-level investigation, because SmartScreen uses both file-hash reputation and signing-certificate publisher reputation. A negative publisher signal can affect multiple files signed with the same certificate

If the WD Response page rejects the account or requires Microsoft-internal credentials, there does not appear to be a publicly documented developer email address or separate external form. In that case, the remaining path would be to open a general Microsoft Support case for Windows SmartScreen and ask the support engineer to escalate it internally to Defender Research, providing the existing submission IDs. The published developer FAQ currently provides no alternative process for submissions that never reach a final determination