Windows Defender flags v0.39.0 Windows asset as Trojan:Win32/Bearfoos.B!ml

Summary

Microsoft Defender Antivirus flags the official v0.39.0 Windows release asset as Trojan:Win32/Bearfoos.B!ml.

Affected asset

• Release: v0.39.0
• Asset: rtk-x86_64-pc-windows-msvc.zip
• URL: https://github.com/rtk-ai/rtk/releases/download/v0.39.0/rtk-x86_64-pc-windows-msvc.zip
• Official GitHub asset digest: sha256:aad430c14d82b4470f14bdb9695e8cd97aeac97444bd087bd70be161ced09cb7
• Local ZIP SHA256: AAD430C14D82B4470F14BDB9695E8CD97AEAC97444BD087BD70BE161CED09CB7
• Local ZIP size: 3,846,431 bytes

Defender detection

• Detection: Trojan:Win32/Bearfoos.B!ml
• Threat ID: 2147731849
• Severity: Severe
• Category: Trojan
• Defender security intelligence: AV/AS/NIS 1.449.506.0
• Engine: 1.1.26030.3008
• Action: Quarantine
• DidThreatExecute: False
• First detection: 2026-05-08 03:26:34 local time
• Process: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Affected local paths

• C:\Users\Arthur A. Martins\.local\bin\rtk.exe
• C:\Users\Arthur A. Martins\AppData\Local\Temp\rtk-18614f5410514dccac17eceb1d8b6902\rtk.exe

Notes

The local ZIP hash matches the official GitHub release asset digest, so this does not look like local tampering of the downloaded archive. Defender blocks the extracted executable when attempting to hash or inspect it.

I am also submitting the file/hash to Microsoft Security Intelligence as a likely false positive.

Related prior reports: #1633, #1749.