Repository navigation
Windows Defender Detected: Trojan:Win32/Wacatac.H!ml #13517
Description
Description
I understand this has been brought up already, but none of the threads have an actual root cause other than opentui. That's not really any answer.
Why does version v1.1.56 download and install without any detections found while later versions, to include the latest v1.1.65 get these flags for the trojan?
Plugins
None
OpenCode version
Any
Steps to reproduce
Download the latest version exe and scan it
Screenshot and/or share link
Operating System
Windows 11
Terminal
OpenCode Windows Application
Activity
github-actions commentedon Feb 13, 2026
This issue appears to be a duplicate of existing reports about Windows Defender flagging OpenCode as malware. Please check these related issues:
Trojan:Win32/Wacatac.H!mlwhen running opencode #7592: [False Positive?] Windows Defender detectsTrojan:Win32/Wacatac.H!mlwhen running opencodeSince this is a known issue affecting multiple users, please consider consolidating your feedback in one of the existing threads to help maintainers track the scope and severity of the problem.
Vistiqx commentedon Feb 16, 2026
I have checked these already, and none of them seem to have a solution to the problem other than "its false". This isn't the answer, fixing it so this is no longer happening is the answer.. Since it did not happen in previous version and now is happening should help narrow down when and what was changed to cause the issue.
Unmask06 commentedon Mar 5, 2026
Vistiqx commentedon Mar 8, 2026
Obviously we can Quarantine an infected file, my point was the fact it is being detected in the first place. If the software is built correctly an end user should not get these errors, due to "false positives", so the question still remains, when will this issue be properly fixed and an update provided.
Unmask06 commentedon Mar 8, 2026
I really got bashed in office for using OPENCODE because of this issue
Couldn't explain them that this is false positive. Do something in priority
Hona commentedon Mar 29, 2026
As of OpenCode v1.3.4 across the CLI + Desktop apps, we have full code signing - so there should be no more warnings.
Please let me know otherwise