pua:win32/frproxy

[Jaaaarne]

Windows Defender on Win10 detects pua:win32/frproxy in Hiddify portable app. I cannot seem to find whether it is legit or not. Kaspersky suite doesn't detect such malware (?), and no sufficient description is given at Microsoft website. Is it a problem, or is it supposed to be there? Is it really a malware?

[Fragerjap]

The same goes for installable [v4.1.1] .exe version, specifically in:
Hiddify\HiddifyCli.exe

[arcticloud]

It's a false positive. PUA:Win32/FRProxy is a heuristic category Microsoft applies to proxy software in general ("Fake/Forced/Free proxy"), not a signature of actual malware. It fires on HiddifyCli.exe because that binary embeds the sing-box proxy core — Defender sees "this program can reroute your traffic" and flags it as potentially-unwanted, which is exactly what a VPN/proxy tool does by design. That's why Kaspersky doesn't flag it and why Microsoft's page has no real description: there's no malware behavior to describe.

How to be sure for yourself: Hiddify is open source and its releases are built from public source via GitHub Actions, so the binary is reproducible from code you can read. As long as you downloaded it from the official GitHub releases (not a random mirror), it's safe.

Practical fix: add an exclusion for the Hiddify folder in Windows Security → Virus & threat protection → Exclusions, or restore it from quarantine. Just keep downloading only from the official release page so an exclusion never masks a truly tampered build.