Skip to content

False-Positive: New binaries are incorrectly flagged as malicious (12.2.2) #8184

Open
Open
False-Positive: New binaries are incorrectly flagged as malicious (12.2.2)#8184
Labels
kind/triageUnclassified issues

Description

@radiolondra
radiolondra
opened on Apr 17, 2026

Problem Description

I downloaded the Windows binaries for the new version of mitmproxy (rel. 12.2.2) from:
https://www.mitmproxy.org/downloads/#12.2.2/ and extracted mitmproxy into a folder. Windows Defender immediately quarantined it because, apparently, it contains a Trojan:Win32/Wacatac.H!ml.
Just so you know.

Image

System Information

Checklist

Activity

  1. radiolondra
    added
    kind/triageUnclassified issues
    on Apr 17, 2026

  2. mhils commented on Apr 17, 2026

    @mhils
    mhils
    on Apr 17, 2026
    Member

    This looks like a false positive to me. We probably need to report this to Microsoft.

  3. vovkasm commented on Apr 18, 2026

    @vovkasm
    vovkasm
    on Apr 18, 2026

    Seems it is something not on mitmproxy/user side, but in between...
    Be accurate, I experienced somewhat related problem. Few days ago Homebrew can't download update, curl reported errors related to SSL cert. I did checked issues, not found and just waited... Today I did some shallow experiments...

    Original situation

    Direct connection to provider (one of providers in Montenegro)
    There are dragons here!!!!

    $ nslookup mitmproxy.org
Non-authoritative answer:
Name:	mitmproxy.org
Address: 172.67.222.1
Name:	mitmproxy.org
Address: 104.21.38.107
$ nslookup downloads.mitmproxy.org
Non-authoritative answer:
Name:	downloads.mitmproxy.org
Address: 213.133.2.189
    Image

    VPN (private pod at DigitalOcean)

    All looks correct

    $ nslookup mitmproxy.org
Non-authoritative answer:
Name:	mitmproxy.org
Address: 104.21.38.107
Name:	mitmproxy.org
Address: 172.67.222.1
$ nslookup downloads.mitmproxy.org
Non-authoritative answer:
Name:	downloads.mitmproxy.org
Address: 172.67.222.1
Name:	downloads.mitmproxy.org
Address: 104.21.38.107
    Image

  4. AeioMuch commented on Apr 18, 2026

    @AeioMuch
    AeioMuch
    on Apr 18, 2026

    I got a report for Trojan:Win32/Ravartar!rfn

  5. tczaude commented on Apr 20, 2026

    @tczaude
    tczaude
    on Apr 20, 2026

    Eset raported too under another name propably

    20.04.2026 08:22:52;Ochrona systemu plików w czasie rzeczywistym;plik;C:\Program Files\WindowsApps\8637MaximilianHils.mitmproxy_12.2.2.0_x64__b9jqetyr0hqq6\_internal\mitmproxy_rs\mitmproxy_rs.pyd;odmiana wykrycia Python/Riskware.HackTool.F aplikacja;wyleczone przez usunięcie;ZARZĄDZANIE NT\SYSTEM;Zdarzenie wystąpiło podczas tworzenia nowego pliku przez aplikację: C:\Windows\System32\svchost.exe (D87367D5078C476B109DC3312B62781513330055).;B33ECB07A19E563EEAAF2FCE49E9FB136A847A81;20.04.2026 08:22:35;S-1-5-18;;yKl5f6OaP0HbgDwApvdZLg==

  6. vovkasm commented on Apr 20, 2026

    @vovkasm
    vovkasm
    on Apr 20, 2026

    Virustotal seems to be okay when scanning download link

    But when I downloaded it, unpack and uploaded just mitmproxy.exe it all red: https://www.virustotal.com/gui/file/3c0ffbe5de5777c8da46f7e13ef175130b3fec7b825d735427c45083b5f4bdde

    btw, I analyzed windows zip download

    UPD: actually some of them correctly detect just a "hack tool", but others like microsoft detects it as really something dangerous (

    Image

  7. mhils commented on Apr 20, 2026

    @mhils
    mhils
    on Apr 20, 2026
    Member

    A lot of those detections seem to come from WinDivert. I think we may be able to drop that as a dependency with our local redirect mode.

    (Again: This looks like a false positive to me)

  8. Patrosi73 commented on Apr 24, 2026

    @Patrosi73
    Patrosi73
    on Apr 24, 2026

    ESET reports another false positive as well:

    Image

  9. radiolondra commented on May 4, 2026

    @radiolondra
    radiolondra
    on May 4, 2026
    Author

    Windows Defender continues to quarantine mitmdump, mitmproxy, and mitmweb version 12.2.2. This version is still unusable.

    Image

  10. aurora commented on May 5, 2026

    @aurora
    aurora
    on May 5, 2026

    Eset is reporting it, too ...

    Image

    Installation from Microsoft Store does not work either:

    Image

    I was about to reinstall it, because my installation stopped working with the following exception (from one day to the other) 🤔

    PS C:\Users\xxx> mitmproxy
    Traceback (most recent call last):
    File "mitmproxy.py", line 2, in
    File "pyimod02_importers.py", line 457, in exec_module
    File "mitmproxy\tools\main.py", line 15, in
    File "pyimod02_importers.py", line 457, in exec_module
    File "mitmproxy\master.py", line 5, in
    File "pyimod02_importers.py", line 457, in exec_module
    File "mitmproxy\addons_init_.py", line 3, in
    File "pyimod02_importers.py", line 457, in exec_module
    File "mitmproxy\addons\block.py", line 5, in
    File "pyimod02_importers.py", line 457, in exec_module
    File "mitmproxy\proxy\mode_specs.py", line 36, in
    File "pyimod02_importers.py", line 457, in exec_module
    File "mitmproxy_rs_init_.py", line 4, in
    ModuleNotFoundError: No module named 'mitmproxy_rs.mitmproxy_rs'

  11. Anthony-76 commented on May 6, 2026

    @Anthony-76
    Anthony-76
    on May 6, 2026

    Hi,

    indeed, most of antivirus on Virustotal detect the new binary of mitmproxy like malware.

    It's due to windivert. As @mhils told, it's a false positive.
    But after contact some antivirus vendors, for them, it's a malware.

    This detection is in link with the new binary, not olds and it's difficult to use the new release without to kill by antivirus :(

  12. AndNovAtor commented on May 6, 2026

    @AndNovAtor
    AndNovAtor
    on May 6, 2026

    Sorry for duplicate, but want to throw in my two cents, using the example of ESET (Internet Security)

    1. not only latest windows binaries are affected, but my old version by 24.05.2025 (looks like 12.1.0 version) from zip file is also "affected". So, it's looks like a "new" antivirus heuristic detection (used mitmproxy at least at the end of 2025, there were no problems, the antivirus was the same).
      Same notification, file C:\Users\<user>\AppData\Local\Temp\_MEI108922\mitmproxy_rs\mitmproxy_rs.pyd, detection modified Python/Riskware.HackTool.F app

    2. but I had some "difference" with my old version and the latest version. With old version, only temp file mitmproxy_rs.pyd was "removed" by antivirus.
      However with latest version not only that temp file was "removed", but also main file which exactly was executed (run mitmweb.exe - was removed also that file; run mitmdump.exe - same, was removed also that file).

    3. for me, for now, only "self-contain" binaries are affected (again, looks like the reasons have already been described above).
      Installing mitmproxy from pip to virtualenv is still working (for now)

    So I stick with pip version for now...

  13. mhils
    changed the title [-]Trojan discovered in new binaries (12.2.2)[/-] [+]False-Positive: New binaries are incorrectly flagged as malicious (12.2.2)[/+] on May 12, 2026

  14. breathingcells commented on May 26, 2026

    @breathingcells
    breathingcells
    on May 26, 2026

    The following steps worked for me; your mileage may vary.
    One setback included: a surprise deletion and counter move.

    1. ESET: Blocks download of binary installer, but allows the zip:
      https://www.mitmproxy.org/downloads/#12.2.3/
    • Blocks: mitmproxy-12.2.3-windows-x86_64-installer.exe
    • Allows: mitmproxy-12.2.3-windows-x86_64.zip (81.6 MB)

    1. Cleanup: Settings > Apps > Installed Apps>
      Uninstall 2x mitmproxy (if traces)

    2. Cleanup: Delete C:\Program Files\mitmproxy
      (287 MB; 5x rollbackBackupDirectory/)

    3. ESET > Setup > Computer Protection > "Real-time file system protection" >
      Off (for 30min)

    4. Unzip mitmproxy...zip to get the three .exe files

    5. Copy all three to C:\Program Files\mitmproxy\

    6. Add C:\Program Files\mitmproxy\ to PATH
      WinKey > Environment (Edit system environment variables) >
      PATH > Add C:\Program Files\mitmproxy\

    7. ESET: Advanced Setup > Real-time file system protection >
      Processes exclusion > edit > Add > ... (browse) >
      [add all three] > Okay > Okay (Admin)

    9 ESET: Turn "Real-time file system protection" back on.

    1. PowerShell test:
    PS L:\code> mitmdump --version
Mitmproxy: 12.2.3 binary
Python:    3.14.4
OpenSSL:   OpenSSL 3.5.5 27 Jan 2026
Platform:  Windows-11-10.0.26200-SP0

PS L:\code> mitmproxy --version
Mitmproxy: 12.2.3 binary
Python:    3.14.4
OpenSSL:   OpenSSL 3.5.5 27 Jan 2026
Platform:  Windows-11-10.0.26200-SP0

PS L:\code> mitmweb --version
Mitmproxy: 12.2.3 binary
Python:    3.14.4
OpenSSL:   OpenSSL 3.5.5 27 Jan 2026
Platform:  Windows-11-10.0.26200-SP0```
    1. BUT, 20 min later: mitmweb had been deleted (by ESET?):
    PS L:\code> mitmweb
mitmweb: The term 'mitmweb' is not recognized as a name of a cmdlet, function, script file, or executable program.
Check the spelling of the name, or if a path was included, verify that the path is correct and try again.

    1. Add folder to ESET Exclusions, via different path:
      Setup > Computer Protection > Real-time... [down carrot] >
      Edit exclusions > Detection exclusions (list) > Add >
      Add exclusion: Path ... (file/folder; choose folder) >

    2. Working with Certificates is a whole nother matter!
      Best of luck!

    Resources: https://support.eset.com/en/kb6530-eset-firewall-is-blocking-a-device-or-application-in-windows-home-products

  15. JamieSee commented on Aug 25, 2026

    @JamieSee
    JamieSee
    on Aug 25, 2026

    I also get the threat identification, Trojan:Win32/Vigorf.A on 12.2.3 in MS Defender.

  16. JamieSee commented on Aug 25, 2026

    @JamieSee
    JamieSee
    on Aug 25, 2026

    A lot of those detections seem to come from WinDivert. I think we may be able to drop that as a dependency with our local redirect mode.

    (Again: This looks like a false positive to me)
    The latest DLL, WinDivert-2.2.2-A.zip, downloaded separately does not flag.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    kind/triageUnclassified issues

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions