[Tracking] Antivirus false positives on HookshotBuilder.exe (Defender Trojan:Script/Wacatac.H!ml)

NotRexed commented

2026-11-09 05:39:15 +00:00

(Migrated from github.com)

This issue collects every open report of antivirus false positives on the builder, so there is one place to follow it. The individual reports were closed pointing here; their logs, screenshots and discussion stay in each linked issue.

Summary

Windows Defender flags or quarantines HookshotBuilder.exe as Trojan:Script/Wacatac.H!ml. The !ml suffix means a machine-learning guess, which Defender often makes for new, unsigned executables. The maintainer has applied for code signing through SignPath (#525). It is not signed yet.

Affected GPUs and versions

Systems: Windows 10 / 11 with Microsoft Defender.
Versions: the new-installer builder and later.

Evidence from the logs

#433: Windows Security flags the builder as a Trojan, still on new-installer.
#525: Trojan:Script/Wacatac.H!ml on HookshotBuilder.exe (5 people).
#991: still flagged on v2.0.6.

Workarounds

Only download HookshotBuilder.exe from this repository's Releases page.
If Defender quarantines it, you can restore it from Protection history, or add an exclusion for that one file. You can also report it to Microsoft as a false positive (https://www.microsoft.com/wdsi/filesubmission).

Reports merged here (3 issues, about 8 people)

Issue	Title	People	GPU	Version	Key detail
#525	HookshotBuilder.exe from the new-builder release flagged and quaranti…	5	-	new-installer	Defender Trojan:Script/Wacatac.H!ml on HookshotBuilder.exe; maintainer applying for SignPath signing; "any fix yet?"
#433	Win11 Detecting as Trojan	2	-	new-installer	Windows Security flags builder as Trojan; still flagged on new-installer
#991	Windows Defender	1	RTX 5070 Ti	v2.0.6	Windows Defender flags the .exe as a trojan on every version incl. v2.0.6 (no detection name given)

Adding a report

Please update to v2.0.6 first (https://github.com/NotRexed/Hookshot/releases/tag/v2.0.6; Update next to Play in the launcher). Please add: the antivirus and the exact detection name, and the version of the builder.

All tracking issues

#993 Garbled / rainbow textures that get worse over play time (VRAM over budget, mostly 4-8 GB cards)
#994 Floating trees, missing mountains and vanishing near vegetation
#995 Low FPS with low GPU usage (CPU-bound), FPS drops in Castle Town / Hyrule Field, shader stutter
#996 AMD on Windows: driver crash, device lost or freeze (RX 5000-9000, Deku Tree / after cutscenes)
#997 AMD handhelds and APUs (ROG Ally / Ally X, Legion Go, Radeon 780M/860M/890M): black screen, device lost, reboot
#998 Black screen with audio after the intro / at the Deku Tree cutscene
#999 Intel Arc and Core Ultra iGPUs: device lost, black screen after the intro, Linux ANV crashes
#1000 Linux and Steam Deck: GPU hangs, crashes, low FPS and build failures
#1001 GPUs without mesh shaders (GTX 9xx/10xx, RX 400/500/5000, Iris Xe/UHD): v2.0.6 fallback reports
#1002 Invisible or missing objects, walls and effects
#1003 Antivirus false positives on HookshotBuilder.exe (Defender Trojan:Script/Wacatac.H!ml)
#1004 Lighting: overexposure, over-bright bloom, crushed or black shadows, black faces
#1005 Flicker and flashing: brightness pulses, one-frame flashes, doubled image with frame pacing
#1006 AMD rendering: white silhouettes, block squares / grid lines, no anti-aliasing (networks in software)
#1007 Feature requests (collected)

This issue collects every open report of antivirus false positives on the builder, so there is one place to follow it. The individual reports were closed pointing here; their logs, screenshots and discussion stay in each linked issue. ## Summary Windows Defender flags or quarantines `HookshotBuilder.exe` as `Trojan:Script/Wacatac.H!ml`. The `!ml` suffix means a machine-learning guess, which Defender often makes for new, unsigned executables. The maintainer has applied for code signing through SignPath (#525). It is not signed yet. ## Affected GPUs and versions - **Systems:** Windows 10 / 11 with Microsoft Defender. - **Versions:** the new-installer builder and later. ## Evidence from the logs - **#433:** Windows Security flags the builder as a Trojan, still on new-installer. - **#525:** `Trojan:Script/Wacatac.H!ml` on HookshotBuilder.exe (5 people). - **#991:** still flagged on v2.0.6. ## Workarounds - Only download `HookshotBuilder.exe` from this repository's Releases page. - If Defender quarantines it, you can restore it from Protection history, or add an exclusion for that one file. You can also report it to Microsoft as a false positive (https://www.microsoft.com/wdsi/filesubmission). ## Reports merged here (3 issues, about 8 people) | Issue | Title | People | GPU | Version | Key detail | |---|---|---|---|---|---| | #525 | HookshotBuilder.exe from the new-builder release flagged and quaranti… | 5 | - | new-installer | Defender Trojan:Script/Wacatac.H!ml on HookshotBuilder.exe; maintainer applying for SignPath signing; "any fix yet?" | | #433 | Win11 Detecting as Trojan | 2 | - | new-installer | Windows Security flags builder as Trojan; still flagged on new-installer | | #991 | Windows Defender | 1 | RTX 5070 Ti | v2.0.6 | Windows Defender flags the .exe as a trojan on every version incl. v2.0.6 (no detection name given) | ## Adding a report Please update to v2.0.6 first (https://github.com/NotRexed/Hookshot/releases/tag/v2.0.6; Update next to Play in the launcher). Please add: the antivirus and the exact detection name, and the version of the builder. ## All tracking issues - #993 Garbled / rainbow textures that get worse over play time (VRAM over budget, mostly 4-8 GB cards) - #994 Floating trees, missing mountains and vanishing near vegetation - #995 Low FPS with low GPU usage (CPU-bound), FPS drops in Castle Town / Hyrule Field, shader stutter - #996 AMD on Windows: driver crash, device lost or freeze (RX 5000-9000, Deku Tree / after cutscenes) - #997 AMD handhelds and APUs (ROG Ally / Ally X, Legion Go, Radeon 780M/860M/890M): black screen, device lost, reboot - #998 Black screen with audio after the intro / at the Deku Tree cutscene - #999 Intel Arc and Core Ultra iGPUs: device lost, black screen after the intro, Linux ANV crashes - #1000 Linux and Steam Deck: GPU hangs, crashes, low FPS and build failures - #1001 GPUs without mesh shaders (GTX 9xx/10xx, RX 400/500/5000, Iris Xe/UHD): v2.0.6 fallback reports - #1002 Invisible or missing objects, walls and effects - #1003 Antivirus false positives on HookshotBuilder.exe (Defender Trojan:Script/Wacatac.H!ml) - #1004 Lighting: overexposure, over-bright bloom, crushed or black shadows, black faces - #1005 Flicker and flashing: brightness pulses, one-frame flashes, doubled image with frame pacing - #1006 AMD rendering: white silhouettes, block squares / grid lines, no anti-aliasing (networks in software) - #1007 Feature requests (collected)

TovaK66 commented

2026-11-09 06:05:37 +00:00

(Migrated from github.com)

Hi! I'm experiencing the same issue with Hookshot v2.0.6 on Windows 11.

Microsoft Defender immediately blocks and removes HookshotBuilder.exe when downloading it from the official GitHub release.

Confirmed detection:

Version: v2.0.6
Antivirus: Microsoft Defender
Threat: Trojan:Win32/Wacatac.H!ml
Threat ID: 2147814523
Severity ID: 5
Detection date: November 9, 2026, at 06:57

I confirmed the detection name using PowerShell (Get-MpThreat).

The previous version, v2.0.5, was also blocked on my PC, but with a different detection: Program:Win32/Contebrew.A!ml.

I've seen that code signing through SignPath is being pursued and that builds have been submitted to Microsoft.

Has Microsoft provided any feedback or confirmed that these detections are false positives?

I'd really like to test Hookshot natively, but I'd prefer not to disable Defender or create an antivirus exclusion without further verification.

Thanks for your work on this project!

Hi! I'm experiencing the same issue with **Hookshot v2.0.6** on Windows 11. Microsoft Defender immediately blocks and removes `HookshotBuilder.exe` when downloading it from the official GitHub release. **Confirmed detection:** - Version: v2.0.6 - Antivirus: Microsoft Defender - Threat: `Trojan:Win32/Wacatac.H!ml` - Threat ID: `2147814523` - Severity ID: `5` - Detection date: November 9, 2026, at 06:57 I confirmed the detection name using PowerShell (`Get-MpThreat`). The previous version, v2.0.5, was also blocked on my PC, but with a different detection: `Program:Win32/Contebrew.A!ml`. I've seen that code signing through SignPath is being pursued and that builds have been submitted to Microsoft. **Has Microsoft provided any feedback or confirmed that these detections are false positives?** I'd really like to test Hookshot natively, but I'd prefer not to disable Defender or create an antivirus exclusion without further verification. Thanks for your work on this project!

TovaK66 commented

2026-11-09 22:21:30 +00:00

(Migrated from github.com)

Quick update: I just tested Hookshot v2.0.11, and Microsoft Defender is still blocking HookshotBuilder.exe.

New detection:

Version: v2.0.11
Threat: Trojan:Win32/Wacatac.B!ml
Threat ID: 2147735505
Detection date: November 9, 2026, at 23:17
OS: Windows 11

This is now the third version I've tested, with three different Defender detections (v2.0.5, v2.0.6, and v2.0.11).

The installer was downloaded directly from the official GitHub release.

I'm keeping Defender enabled and waiting for further confirmation regarding these detections.

Quick update: I just tested **Hookshot v2.0.11**, and Microsoft Defender is still blocking `HookshotBuilder.exe`. **New detection:** - Version: v2.0.11 - Threat: `Trojan:Win32/Wacatac.B!ml` - Threat ID: `2147735505` - Detection date: November 9, 2026, at 23:17 - OS: Windows 11 This is now the third version I've tested, with three different Defender detections (v2.0.5, v2.0.6, and v2.0.11). The installer was downloaded directly from the official GitHub release. I'm keeping Defender enabled and waiting for further confirmation regarding these detections.

👍 1

onlinenow81 commented

2026-11-10 00:18:47 +00:00

(Migrated from github.com)

Hookshot v2.0.11 — Microsoft Defender still detects and removes HookshotBuilder.exe

I tested Hookshot v2.0.11 on Windows 11, and Microsoft Defender is still flagging HookshotBuilder.exe as a Trojan.

Detection details:

Version: v2.0.11
Threat: Trojan:Win32/Wacatac.B!ml
Threat ID: 2147735505
Severity: Severe
Status: Removed
OS: Windows 11

Steps to reproduce:

Download HookshotBuilder.exe from the official GitHub release.
Keep Microsoft Defender real-time protection enabled.
Defender immediately detects and removes the executable before it can be launched.

Expected behavior: The official installer should download and run without being flagged as malware, assuming the detection is a false positive.

Actual behavior: Defender automatically removes the downloaded file.

I previously encountered the same issue with v2.0.5, and reports indicate that v2.0.6 was also affected. The problem remains reproducible in v2.0.11.

I have not disabled Defender or added any security exclusions. I'm waiting for further confirmation or a fix from the developers.

### Hookshot v2.0.11 — Microsoft Defender still detects and removes HookshotBuilder.exe I tested **Hookshot v2.0.11** on Windows 11, and Microsoft Defender is still flagging `HookshotBuilder.exe` as a Trojan. **Detection details:** - Version: v2.0.11 - Threat: `Trojan:Win32/Wacatac.B!ml` - Threat ID: `2147735505` - Severity: Severe - Status: Removed - OS: Windows 11 **Steps to reproduce:** 1. Download `HookshotBuilder.exe` from the official GitHub release. 2. Keep Microsoft Defender real-time protection enabled. 3. Defender immediately detects and removes the executable before it can be launched. **Expected behavior:** The official installer should download and run without being flagged as malware, assuming the detection is a false positive. **Actual behavior:** Defender automatically removes the downloaded file. I previously encountered the same issue with v2.0.5, and reports indicate that v2.0.6 was also affected. The problem remains reproducible in v2.0.11. I have not disabled Defender or added any security exclusions. I'm waiting for further confirmation or a fix from the developers.

👍 3

xyh67 commented

2026-11-10 10:38:47 +00:00

(Migrated from github.com)

Windows Defender blocked the download of the Windows builder from the Hookshot v2.0.12 GitHub release on Windows 11.

File: HookshotBuilder (1).exe
Detection: Trojan:Win32/Wacatac.H!ml (threat ID 2147814523)
Protection History: severity Severe, status Removed

The browser showed “Failed – Virus detected.” Defender removed the file, so I could not verify its SHA-256. The detection is the Win32 variant, while the tracking issue lists the Script variant. Has the official v2.0.12 builder been submitted to Microsoft for review?

Windows Defender blocked the download of the Windows builder from the Hookshot v2.0.12 GitHub release on Windows 11. - File: `HookshotBuilder (1).exe` - Detection: `Trojan:Win32/Wacatac.H!ml` (threat ID `2147814523`) - Protection History: severity **Severe**, status **Removed** The browser showed “Failed – Virus detected.” Defender removed the file, so I could not verify its SHA-256. The detection is the Win32 variant, while the tracking issue lists the Script variant. Has the official v2.0.12 builder been submitted to Microsoft for review?

Motoko2999 commented

2026-11-10 17:11:50 +00:00

(Migrated from github.com)

I’m experiencing the exact same issue. I downloaded HookshotBuilder.exe directly from the official GitHub releases page, but Microsoft Defender immediately blocked and removed the file.

Detection: Trojan:Win32/Wacatac.H!ml
Severity: Severe
Status: Removed

I was really looking forward to testing Hookshot, especially after seeing the recent performance improvements and gameplay videos. However, I’m not comfortable disabling Windows Defender or adding an antivirus exception.

Is there any progress on getting the installer digitally signed through SignPath? I’d love to try the project once this issue is resolved.

Thanks for all your hard work!

I’m experiencing the exact same issue. I downloaded HookshotBuilder.exe directly from the official GitHub releases page, but Microsoft Defender immediately blocked and removed the file. Detection: Trojan:Win32/Wacatac.H!ml Severity: Severe Status: Removed I was really looking forward to testing Hookshot, especially after seeing the recent performance improvements and gameplay videos. However, I’m not comfortable disabling Windows Defender or adding an antivirus exception. Is there any progress on getting the installer digitally signed through SignPath? I’d love to try the project once this issue is resolved. Thanks for all your hard work!

NotRexed commented

2026-11-11 21:21:57 +00:00

(Migrated from github.com)

More reports of this, collected here:

#2232: Help???
#2256: Defender False positive virus alert
#2350: it the launcher a virus or not
#2421: Windows Defender flags the build as Trojan.

More reports of this, collected here: - #2232: Help??? - #2256: Defender False positive virus alert - #2350: it the launcher a virus or not - #2421: Windows Defender flags the build as Trojan.

github-sync commented

2026-11-12 06:22:46 +00:00

Owner

@jrbailey2 commented on GitHub · 2026-11-12 04:38 UTC · original

My findings regarding Windows 11 Smart App Control and Windows Security blocking HookshotBuilder.exe.

Builder v2.0.12 worked on my system and successfully updates the latest Hookshot files, while newer builder versions were blocked.
The generated hookshot.exe V2.1.0 began working following Windows security updates and DISM/SFC repairs.

Full testing results and workaround: #525

> [@jrbailey2](https://github.com/jrbailey2) commented on GitHub · 2026-11-12 04:38 UTC · [original](https://github.com/NotRexed/Hookshot/issues/1003#issuecomment-6814690796) My findings regarding Windows 11 Smart App Control and Windows Security blocking HookshotBuilder.exe. Builder v2.0.12 worked on my system and successfully updates the latest Hookshot files, while newer builder versions were blocked. The generated hookshot.exe V2.1.0 began working following Windows security updates and DISM/SFC repairs. Full testing results and workaround: https://git.magicbean.dev/MagicBeanDev/Hookshot/issues/525

github-sync referenced this issue

2026-11-12 06:26:18 +00:00

Trojan in the .exe #1340

github-sync commented

2026-11-12 17:57:35 +00:00

Owner

@StelioKantos commented on GitHub · 2026-11-12 17:10 UTC · original

Mine, Win11 26H2 did not detect nor quarantine until after building and clicking play. Halfway through the pipeline compilation, Defender removed Hookshot.exe itself as well as HookshotBuilder.exe. It labeled them as Wacatac, and Cloxer, respectively. For whatever that's worth.

> [@StelioKantos](https://github.com/StelioKantos) commented on GitHub · 2026-11-12 17:10 UTC · [original](https://github.com/NotRexed/Hookshot/issues/1003#issuecomment-6830482436) Mine, Win11 26H2 did not detect nor quarantine until after building and clicking play. Halfway through the pipeline compilation, Defender removed Hookshot.exe itself as well as HookshotBuilder.exe. It labeled them as Wacatac, and Cloxer, respectively. For whatever that's worth.

Rows
Columns

[Tracking] Antivirus false positives on HookshotBuilder.exe (Defender Trojan:Script/Wacatac.H!ml) #1003

Summary

Affected GPUs and versions

Evidence from the logs

Workarounds

Reports merged here (3 issues, about 8 people)

Adding a report

All tracking issues

Hookshot v2.0.11 — Microsoft Defender still detects and removes HookshotBuilder.exe