🐛 Latest release (2026.1.1) contains trojan virus

[jvherck]

Describe the bug
When downloading cloudflared version 2026.1.1 for windows amd64 using either exe or msi, both have been blocked multiple times by Windows Defender, being flagged for containing a Trojan virus. It looks like the msi installer has a Vigorf.A trojan and the exe installer has a Kepavll!rfn trojan (see screenshots below).

To Reproduce
Steps to reproduce the behavior:

1. Download cloudflared-windows-amd64.msi or cloudflared-windows-amd64.exe of version 2026.1.1

Expected behavior
Not to contain a virus...

Environment and versions

• OS: Windows
• Architecture: AMD
• Version: 25H2 (26200.7462)

Workaround
Installing the previous version (2025.11.1) fixes this. It does not get flagged for any viruses.

Logs and errors

[bstlaurent-ccnz]

Just confirming I'm seeing the same result.

Uploading the file to virustotal, I get the following output:

[Fogh]

Seeing the same thing for Mac binaries

[nikitacano]

This is a reappearance of #1535, we are actively investigating why this now affects newly signed binaries. As in #1535 (comment), the issue is a false positive.

[ITXcseidel]

Having same issue, my cooperate virus scanner (ESET.NOD32) treats it like a virus "WinGo.Cloudflared.A" and always deletes all binaries for it. cloudflared is used in Atlassian Forge CLI and i am unable to use their tunneling feature.

[onlinegroeicoach]

Chrome browser and Edge browser in Windows 11 also flags this as a virus (x64 Windows version).