AV detected Sunshine as threat

[DemonicGiraffe]

Is there an existing issue for this?

• I have searched the existing issues

Is your issue described in the documentation?

• I have read the documentation

Is your issue present in the latest beta/pre-release?

This issue is present in the latest pre-release

Describe the Bug

Windows Defender labels the latest pre-release as a Trojan:Script/Wacatac.H!ml taking it into virus total, I get this where its labeled FileRepMalware

compared to the stable release virus total

Expected Behavior

No response

Additional Context

No response

Host Operating System

Windows

Operating System Version

24H2

Architecture

amd64/x86_64

Sunshine commit or version

v2025.609.163957

Package

Windows - installer (recommended)

GPU Type

NVIDIA

GPU Model

RTX 4070 Ti Super

GPU Driver/Mesa Version

566.36

Capture Method

None

Config

Apps

Relevant log output

N/A

[DanielF823]

I am getting the same flag - first time yet...

[R-T-B]

I am getting the same, and with latest release the virustotal is better, but still not completely squeaky clean.

I'm assuming it's a false positive (I've been on the wrong end of these in the past as a fellow dev and know how "viral" a single false positive can be amongst the reporting of AV services, ironic really) but some reassurance from the devs about what may have triggered this in that release would be nice.

EDIT: May be linked to this service provider updating their dbs, unsure:

https://live.paloaltonetworks.com/t5/virustotal/false-positive-detection-generic-ml-sunshine/td-p/1065925

[ReenigneArcher]

Someone on discord mentioned that Wacatac is basically a scam by Microsoft to try to get small developers to pony up and buy certificates for code signing.

[ReenigneArcher]

There isn't very much information about what it is on Microsoft's page: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Trojan%3AWin32%2FWacatac.H!ml&msockid=3b67194a59626b0529cc0c0458046abd

[R-T-B]

I very much appreciate the reassurance.

To back up what the dev said, I do both OSS work (mod dlls for KSP and other games, see my github profile) and commercial work for my job at a small court reporting firm. At the firm, we have a code signing cert, but they are NOT easy to attain. I've never had my work software flagged but my OSS mods get flagged semi-regularly for reasons like "hasn't been downloaded enough." It is pretty much a mild mannered extortion racket on smaller devs.

So yeah, your explanation 100% tracks. Thanks anyways.

[stefanilijev97]

The "Wacatac" flag is not really worrying... the bad part is that when you scan with virus scanner, a couple of vendors flag it as a miner also.. and this wasn't the case with the older versions.

[stefanilijev97]

[ReenigneArcher]

At this point I wonder if we're being sabotaged, because a few days ago there was 1 or 2 listed.

[twindan]

Copying some notes from my duplicate bug:

Here's the latest stable:
https://www.virustotal.com/gui/file/c38e13fdc999cd1124e31ce66349891c4502425cd9154d362ff434722e27ebfc

Here's the latest pre-release:
https://www.virustotal.com/gui/file/c38e13fdc999cd1124e31ce66349891c4502425cd9154d362ff434722e27ebfc

Older versions, such as v2025.122.141614 do not exhibit this problem. Currently 18/71 anti-viruses are flagging it and the number has increased from a few hours ago.

[stefanilijev97]

At this point I wonder if we're being sabotaged, because a few days ago there was 1 or 2 listed.

Sabotaged by whom exactly? Also, there were 7-8 of detections for a weeks based on the pre-releases… with the current stable release the number is 20 right now… The stable version from January had 1-2 detections…