[GH-ISSUE #5731] Multiple VirusTotal detections for netbird_darwin_arm64.pkg #11699

Open
opened 2026-08-05 01:30:33 -04:00 by saavagebueno · 5 comments
Owner

Originally created by @RiatRayendra on GitHub (Mar 30, 2026).
Original GitHub issue: https://github.com/netbirdio/netbird/issues/5731

Hello!
It looks like the macOS ARM64 packages are currently triggering malicious detections. Specifically, we check 2 sample pkg netbird_0.67.1_darwin_arm64.pkg and netbird_0.67.0_darwin_arm64.pkg are showing flags on VirusTotal:
https://www.virustotal.com/gui/file/7eaece319adc87da0d0719a5f648d1e31d5ad1767d8f2ecd433786090a96cee6
Image

https://www.virustotal.com/gui/file/b0328409616e8d7395f1e5ded9dbacff9f6a662198906a82a62bef5ff2678ecf
Image

Is the team aware of this? We'd appreciate a confirmation on why these are being flagged malicious.
Thank you.

Originally created by @RiatRayendra on GitHub (Mar 30, 2026). Original GitHub issue: https://github.com/netbirdio/netbird/issues/5731 Hello! It looks like the macOS ARM64 packages are currently triggering malicious detections. Specifically, we check 2 sample pkg `netbird_0.67.1_darwin_arm64.pkg` and `netbird_0.67.0_darwin_arm64.pkg` are showing flags on VirusTotal: https://www.virustotal.com/gui/file/7eaece319adc87da0d0719a5f648d1e31d5ad1767d8f2ecd433786090a96cee6 <img width="1899" height="683" alt="Image" src="https://github.com/user-attachments/assets/a661dbd1-1880-4223-b389-f00e22213392" /> https://www.virustotal.com/gui/file/b0328409616e8d7395f1e5ded9dbacff9f6a662198906a82a62bef5ff2678ecf <img width="1919" height="939" alt="Image" src="https://github.com/user-attachments/assets/3f002894-8d92-44cc-8a12-dc1cf5b57d7f" /> Is the team aware of this? We'd appreciate a confirmation on why these are being flagged malicious. Thank you.
saavagebueno added the triage-needed label 2026-08-05 01:30:33 -04:00
Author
Owner

@mlsmaycon commented on GitHub (Mar 31, 2026):

Thanks for reporting @RiatRayendra. Seems like a false positive for Avira and withSecure. We will check if these tools has an whitelist program. In the meantime can you confirm that you submitted the files for analysis?

<!-- gh-comment-id:4160275795 --> @mlsmaycon commented on GitHub (Mar 31, 2026): Thanks for reporting @RiatRayendra. Seems like a false positive for Avira and withSecure. We will check if these tools has an whitelist program. In the meantime can you confirm that you submitted the files for analysis?
Author
Owner

@RiatRayendra commented on GitHub (Mar 31, 2026):

Hi @mlsmaycon , thank you for the response.

Regarding your question, I am currently unable to download the files to submit them because they are being automatically blocked by our XDR (Check Point Harmony). We have already opened a ticket with their support team, but we are still waiting for a resolution.

To clarify the scope of the issue:

Source: We obtained the file directly from the official Netbird repo: https://github.com/netbirdio/netbird/releases/download/v0.67.1/netbird_0.67.1_darwin_arm64.pkg.

Detection: It seems that the Darwin versions are being flagged by several vendors. This isn't limited to just the latest release, older versions appear to be affected as well.

Verification: You can verify this via the VirusTotal link I shared earlier. Alternatively, if you upload any Darwin ARM agent from the official repo and run a Reanalyze, you will see the malware detections.

Here I attached a capture from our Check Point Harmony XDR threat emulation and forensics report for that files, until now installer file still flag as malicious file
Image

Image
<!-- gh-comment-id:4160500610 --> @RiatRayendra commented on GitHub (Mar 31, 2026): Hi @mlsmaycon , thank you for the response. Regarding your question, I am currently unable to download the files to submit them because they are being automatically blocked by our XDR (Check Point Harmony). We have already opened a ticket with their support team, but we are still waiting for a resolution. To clarify the scope of the issue: Source: We obtained the file directly from the official Netbird repo: https://github.com/netbirdio/netbird/releases/download/v0.67.1/netbird_0.67.1_darwin_arm64.pkg. Detection: It seems that the Darwin versions are being flagged by several vendors. This isn't limited to just the latest release, older versions appear to be affected as well. Verification: You can verify this via the VirusTotal link I shared earlier. Alternatively, if you upload any Darwin ARM agent from the [official repo](https://github.com/netbirdio/netbird/releases) and run a Reanalyze, you will see the malware detections. Here I attached a capture from our Check Point Harmony XDR threat emulation and forensics report for that files, until now installer file still flag as malicious file <img width="471" height="268" alt="Image" src="https://github.com/user-attachments/assets/ad8f6e88-bed2-4ebb-b2fc-519ea72d10d8" /> <img width="468" height="350" alt="Image" src="https://github.com/user-attachments/assets/a6b83d4d-d609-4634-a6ed-6c34881910a2" />
Author
Owner

@mlsmaycon commented on GitHub (Mar 31, 2026):

Thanks for the additional information. Harmony should have a whitelist program. We will check and submit our package for analysis.

<!-- gh-comment-id:4160515138 --> @mlsmaycon commented on GitHub (Mar 31, 2026): Thanks for the additional information. Harmony should have a whitelist program. We will check and submit our package for analysis.
Author
Owner

@PowershellScripter commented on GitHub (Mar 31, 2026):

This is definitely a false positive and is likely due to the .pkg file exposing certain metadata or commands that are being flagged by the engines used.

Out of 61 total engines VT uses, only 2 flagged it. A good indicator is if the top engines of VirusTotal flag it and Avira is not one of the top. An AV engine will flag something not just because its malicious, but can also do so if the logic applied uses what could be deemed as suspicious behavior and the default is to just flag it for further inspection. Because NetBird uses wireguard, creates tap connections and reports to an external server, engines can see this as a potential RAT. By now, major companies should know NetBird's package signatures, but some dont update their engines often enough or dont have the necessary logic to understand if a package truly is malicious or not.

Bitdefender and Kaspersky (foreign claims aside) are 2 of the top leading AV because of their advanced engines and logic algorithms. We use BitDefender in our env and I checked all the packages against it and Bitdefender registers them as clean.

<!-- gh-comment-id:4161036179 --> @PowershellScripter commented on GitHub (Mar 31, 2026): This is definitely a false positive and is likely due to the .pkg file exposing certain metadata or commands that are being flagged by the engines used. Out of 61 total engines VT uses, only 2 flagged it. A good indicator is if the top engines of VirusTotal flag it and Avira is not one of the top. An AV engine will flag something not just because its malicious, but can also do so if the logic applied uses what could be deemed as suspicious behavior and the default is to just flag it for further inspection. Because NetBird uses wireguard, creates tap connections and reports to an external server, engines can see this as a potential RAT. By now, major companies should know NetBird's package signatures, but some dont update their engines often enough or dont have the necessary logic to understand if a package truly is malicious or not. Bitdefender and Kaspersky (foreign claims aside) are 2 of the top leading AV because of their advanced engines and logic algorithms. We use BitDefender in our env and I checked all the packages against it and Bitdefender registers them as clean.
Author
Owner

@PowershellScripter commented on GitHub (Mar 31, 2026):

Hi @mlsmaycon , thank you for the response.

Regarding your question, I am currently unable to download the files to submit them because they are being automatically blocked by our XDR (Check Point Harmony). We have already opened a ticket with their support team, but we are still waiting for a resolution.

To clarify the scope of the issue:

Source: We obtained the file directly from the official Netbird repo: https://github.com/netbirdio/netbird/releases/download/v0.67.1/netbird_0.67.1_darwin_arm64.pkg.

Detection: It seems that the Darwin versions are being flagged by several vendors. This isn't limited to just the latest release, older versions appear to be affected as well.

Verification: You can verify this via the VirusTotal link I shared earlier. Alternatively, if you upload any Darwin ARM agent from the official repo and run a Reanalyze, you will see the malware detections.

Here I attached a capture from our Check Point Harmony XDR threat emulation and forensics report for that files, until now installer file still flag as malicious file Image

Image

Harmony's XDR uses an AI algorithm that most likely doesnt have the provided signatures or its logic is built with more safeguards and its causing a false positive. We use Checkpoint Email Security which uses another one of their LLMs and it generates false positives than I would like. I think their LLMs are built to be more aggressive than intelligent. What will likely happen is that CheckPoint will just whitelist them rather than train their LLM to understand the necessary logic to determine whether or not NetBird is malicious. Not to speak Ill of companies products but the unfortunate part of CheckPoint is that their engines are 3rd party, so false positives get reported to another company that manages those engines.

<!-- gh-comment-id:4161078340 --> @PowershellScripter commented on GitHub (Mar 31, 2026): > Hi [@mlsmaycon](https://github.com/mlsmaycon) , thank you for the response. > > Regarding your question, I am currently unable to download the files to submit them because they are being automatically blocked by our XDR (Check Point Harmony). We have already opened a ticket with their support team, but we are still waiting for a resolution. > > To clarify the scope of the issue: > > Source: We obtained the file directly from the official Netbird repo: https://github.com/netbirdio/netbird/releases/download/v0.67.1/netbird_0.67.1_darwin_arm64.pkg. > > Detection: It seems that the Darwin versions are being flagged by several vendors. This isn't limited to just the latest release, older versions appear to be affected as well. > > Verification: You can verify this via the VirusTotal link I shared earlier. Alternatively, if you upload any Darwin ARM agent from the [official repo](https://github.com/netbirdio/netbird/releases) and run a Reanalyze, you will see the malware detections. > > Here I attached a capture from our Check Point Harmony XDR threat emulation and forensics report for that files, until now installer file still flag as malicious file <img alt="Image" width="471" height="268" src="https://private-user-images.githubusercontent.com/33806979/571739851-ad8f6e88-bed2-4ebb-b2fc-519ea72d10d8.png?jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3NzQ5NDc5MjEsIm5iZiI6MTc3NDk0NzYyMSwicGF0aCI6Ii8zMzgwNjk3OS81NzE3Mzk4NTEtYWQ4ZjZlODgtYmVkMi00ZWJiLWIyZmMtNTE5ZWE3MmQxMGQ4LnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNjAzMzElMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjYwMzMxVDA5MDAyMVomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTgzMDgyNDgyNjViMzEyMjIzYTcwOWMwZDczNTk3MzM1MDQxZTIyODM2NTgxNDE2NDQ2MjZhNjg1MTdlODU1NGQmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0In0._54hLJSuVZmuk4Xooi-sCJ9LWCb_tiMTbeILShhASSA"> > > <img alt="Image" width="468" height="350" src="https://private-user-images.githubusercontent.com/33806979/571740758-a6b83d4d-d609-4634-a6ed-6c34881910a2.png?jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3NzQ5NDc5MjEsIm5iZiI6MTc3NDk0NzYyMSwicGF0aCI6Ii8zMzgwNjk3OS81NzE3NDA3NTgtYTZiODNkNGQtZDYwOS00NjM0LWE2ZWQtNmMzNDg4MTkxMGEyLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNjAzMzElMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjYwMzMxVDA5MDAyMVomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTFlNWIyMjYwMWRkYmU5Y2VlYTdjZWU2NTkwZWVlODA5YWJkZDJjZmYwZTMwZDk5Yjg2MTdlZmNmOWU2M2E5NjQmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0In0.Hf69J3_zHjWAC9ZbrYC2c43ez6TbRRgkMDFMoMYos-g"> Harmony's XDR uses an AI algorithm that most likely doesnt have the provided signatures or its logic is built with more safeguards and its causing a false positive. We use Checkpoint Email Security which uses another one of their LLMs and it generates false positives than I would like. I think their LLMs are built to be more aggressive than intelligent. What will likely happen is that CheckPoint will just whitelist them rather than train their LLM to understand the necessary logic to determine whether or not NetBird is malicious. Not to speak Ill of companies products but the unfortunate part of CheckPoint is that their engines are 3rd party, so false positives get reported to another company that manages those engines.
Sign in to join this conversation.
No Label triage-needed
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: DYNR/netbird#11699