🐛 Latest release (2026.1.1) contains trojan virus

[jvherck]

Describe the bug
When downloading cloudflared version 2026.1.1 for windows amd64 using either exe or msi, both have been blocked multiple times by Windows Defender, being flagged for containing a Trojan virus. It looks like the msi installer has a Vigorf.A trojan and the exe installer has a Kepavll!rfn trojan (see screenshots below).

To Reproduce
Steps to reproduce the behavior:

1. Download cloudflared-windows-amd64.msi or cloudflared-windows-amd64.exe of version 2026.1.1

Expected behavior
Not to contain a virus...

Environment and versions

• OS: Windows
• Architecture: AMD
• Version: 25H2 (26200.7462)

Workaround
Installing the previous version (2025.11.1) fixes this. It does not get flagged for any viruses.

Logs and errors

[bstlaurent-ccnz]

Just confirming I'm seeing the same result.

Uploading the file to virustotal, I get the following output:

[Fogh]

Seeing the same thing for Mac binaries

[nikitacano]

This is a reappearance of #1535, we are actively investigating why this now affects newly signed binaries. As in #1535 (comment), the issue is a false positive.

[ITXcseidel]

Having same issue, my cooperate virus scanner (ESET.NOD32) treats it like a virus "WinGo.Cloudflared.A" and always deletes all binaries for it. cloudflared is used in Atlassian Forge CLI and i am unable to use their tunneling feature.

[onlinegroeicoach]

Chrome browser and Edge browser in Windows 11 also flags this as a virus (x64 Windows version).

[jcsf]

We have just released version 2026.1.2, which we tested, and it seems it is not getting flagged as a virus. Meanwhile, we are trying to understand with Microsoft why changing the certificate that was signing the binary caused this issue.

[Cherno-x]

Some APT use this tools to bypass AV. APTs leverage the tool's traffic forwarding functionality and legitimate digital signature to enable communication between trojans and local services, thereby bypassing antivirus software.

[jcsf]

No problems where detected with version 2026.1.2 and 2026.2.0, so closing this issue.