🐛Windows Defender marking cloudflared 2025.9.1 as Trojan:Win32/Kepavll!rfn

[ondruska]

Steps to reproduce the behavior:

1. Install the cloudflared 2025.9.1 on Windows 11 with Defender.
2. Do a scan.
3. Executable will be marked as severe threat Trojan:Win32/Kepavll!rfn

Environment and versions

• OS: Windows 11 24H2
• Architecture: AMD64
• Version: 2025.9.1

This behavious verified across different computers with different Defender (both consumer and corporate).

[ericcross]

Same issue on Windows Server 2019 Datacenter (v 1809). Installed the update yesterday and today it was flagged in a scan and the windows service and exe file were removed.

[ondruska]

Just a note what I have done from my side:

1. submitted as false positive at https://www.microsoft.com/en-us/wdsi/filesubmission
2. temporarily excluded with Add-MpPreference -AttackSurfaceReductionOnlyExclusions ( Join-Path ${Env:ProgramFiles(x86)} cloudflared/cloudflared.exe )

[gabealex27]

Just a note what I have done from my side:

1. submitted as false positive at https://www.microsoft.com/en-us/wdsi/filesubmission
2. temporarily excluded with Add-MpPreference -AttackSurfaceReductionOnlyExclusions ( Join-Path ${Env:ProgramFiles(x86)} cloudflared/cloudflared.exe )

May you please help me with instructions or something on how you temporarily excluded it? I would really appreciate it and thank you in advance

[ondruska]

May you please help me with instructions or something on how you temporarily excluded it? I would really appreciate it and thank you in advance

Use elevated privileges to run following PowerShell command, given the standard MSI install location of cloudflared:

Add-MpPreference -AttackSurfaceReductionOnlyExclusions ( Join-Path ${Env:ProgramFiles(x86)} cloudflared/cloudflared.exe )

[gabealex27]

May you please help me with instructions or something on how you temporarily excluded it? I would really appreciate it and thank you in advance

Use elevated privileges to run following PowerShell command, given the standard MSI install location of cloudflared:

Add-MpPreference -AttackSurfaceReductionOnlyExclusions ( Join-Path ${Env:ProgramFiles(x86)} cloudflared/cloudflared.exe )

Thanks. So after that do I just reinstall cloudflared tunnel?

[ondruska]

Thanks. So after that do I just reinstall cloudflared tunnel?

Yes, before or after, does not matter. Add-MpPreference does not check resource existence, only controls exclusions. If it does not work you may want to try using https://learn.microsoft.com/en-us/powershell/module/defender/add-mppreference?view=windowsserver2025-ps#-exclusionpath instead of -AttackSurfaceReductionOnlyExclusions, that shall work for sure.

[szczuroskoczek]

+1, can't download neither from official cloudflare nor github releases. other versions and other archs work just fine. I'd also like to add that on version 2025.9.0 SmartScreen also warns users that the publisher could not be verified before proceeding to installation

[northeastprince]

Can confirm latest installer is both unsigned and flagged by Defender (latest stable Windows 11) as malware - I assume Cloudflare can at least address the former?

[ondruska]

Well, Trojan:Script/Wacatac.H!ml was detected by Defender in release 2025.10.0, can we have a statement from Cloudflare if their build process is clean and how are you going to address these if they are false positives?

[8soepSe]

Sudden positives in new releases reminds of how 3CX or SolarWinds got popped. We need to know if this is being reviewed for legitimacy.

[walker164]

Can confirm with 2025.10.0 being marked as trojan by Windows Defender. Just happened this morning. We have it installed on Server 2019 and others. Linux agent seems to be working still. Rolled back to 2025.8.1 and seems to be working.

[northeastprince]

Sudden positives in new releases reminds of how 3CX or SolarWinds got popped. We need to know if this is being reviewed for legitimacy.

cc @DevinCarr

[GTR8000]

Just happened to me on Win 11 Pro. Very odd, never seen this before.