Windows Defender Detected: Trojan:Win32/Wacatac.H!ml #9278

Open
opened 2026-02-16 18:12:04 -05:00 by yindo · 2 comments
Owner

Originally created by @Vistiqx on GitHub (Feb 13, 2026).

Originally assigned to: @rekram1-node on GitHub.

Description

I understand this has been brought up already, but none of the threads have an actual root cause other than opentui. That's not really any answer.

Why does version v1.1.56 download and install without any detections found while later versions, to include the latest v1.1.65 get these flags for the trojan?

Plugins

None

OpenCode version

Any

Steps to reproduce

Download the latest version exe and scan it

Screenshot and/or share link

Image Image

Operating System

Windows 11

Terminal

OpenCode Windows Application

Originally created by @Vistiqx on GitHub (Feb 13, 2026). Originally assigned to: @rekram1-node on GitHub. ### Description I understand this has been brought up already, but none of the threads have an actual root cause other than opentui. That's not really any answer. Why does version v1.1.56 download and install without any detections found while later versions, to include the latest v1.1.65 get these flags for the trojan? ### Plugins None ### OpenCode version Any ### Steps to reproduce Download the latest version exe and scan it ### Screenshot and/or share link <img width="2524" height="1294" alt="Image" src="https://github.com/user-attachments/assets/a8a36af0-fe6a-4183-b9d0-3af16086ce35" /> <img width="2504" height="1162" alt="Image" src="https://github.com/user-attachments/assets/10f7c2eb-900e-48a2-85d7-c089811026ea" /> ### Operating System Windows 11 ### Terminal OpenCode Windows Application
yindo added the windowsbug labels 2026-02-16 18:12:04 -05:00
Author
Owner

@github-actions[bot] commented on GitHub (Feb 13, 2026):


This issue appears to be a duplicate of existing reports about Windows Defender flagging OpenCode as malware. Please check these related issues:

  • #7821: Windows Defender says Found Trojan (Feb 5, 2026)
  • #7919: Windows Defender reports Trojan:Win32/Wacatac.H!ml when launching the latest version
  • #7592: [False Positive?] Windows Defender detects Trojan:Win32/Wacatac.H!ml when running opencode
  • #7669: Threat Found. Trojan:Script/Wacatac.H!ml
  • #3415: Windows Defender falsely flags new releases as trojans

Since this is a known issue affecting multiple users, please consider consolidating your feedback in one of the existing threads to help maintainers track the scope and severity of the problem.

@github-actions[bot] commented on GitHub (Feb 13, 2026): --- This issue appears to be a duplicate of existing reports about Windows Defender flagging OpenCode as malware. Please check these related issues: - #7821: Windows Defender says Found Trojan (Feb 5, 2026) - #7919: Windows Defender reports Trojan:Win32/Wacatac.H!ml when launching the latest version - #7592: [False Positive?] Windows Defender detects `Trojan:Win32/Wacatac.H!ml` when running opencode - #7669: Threat Found. Trojan:Script/Wacatac.H!ml - #3415: Windows Defender falsely flags new releases as trojans Since this is a known issue affecting multiple users, please consider consolidating your feedback in one of the existing threads to help maintainers track the scope and severity of the problem.
Author
Owner

@Vistiqx commented on GitHub (Feb 16, 2026):

I have checked these already, and none of them seem to have a solution to the problem other than "its false". This isn't the answer, fixing it so this is no longer happening is the answer.. Since it did not happen in previous version and now is happening should help narrow down when and what was changed to cause the issue.

@Vistiqx commented on GitHub (Feb 16, 2026): I have checked these already, and none of them seem to have a solution to the problem other than "its false". This isn't the answer, fixing it so this is no longer happening is the answer.. Since it did not happen in previous version and now is happening should help narrow down when and what was changed to cause the issue.
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#9278