[Threat Issue]: Windows Defender flags WandEnhancer Process and the Patch file as a Trojan

[RenTed87]

⚠️ Download Source Confirmation (REQUIRED)

• I confirm that I downloaded this tool DIRECTLY from this official GitHub repository, and NOT from a YouTube video, Discord, or any other third-party website.

Client (Wand) version

12.34.2

Enhancer version

1.0.9.1

Describe the bug

Hello,

After patching Wands with WandEnhancer, Windows Defender eventually detected the "version.dll" file as a Trojan and quarantined it. On my end, it detected it as a Trojan the following day i patched it, upon booting Wands.

Update, Windows Defender is immediately flagging WandEnhancer Process as a Trojan too. Added new picture below.

Cheers!

To Reproduce

1. Download WandEnhancer
2. Run the Program
3. Observe Windows Defender flags the application Process as a Trojan

Also,
4. Patch Wands
5. Launch Wands
6. Observe Windows Defender flags the file "version.dll" as a Trojan

Expected behavior

Windows Defender does not detect the WandEnahancer Process or the Patch as a Trojan.

Screenshots & Additional context

Patch file:

WandEnhancer Process:

[jaylor182]

I ran into the exact same issue, same error from windows defender

[RenTed87]

Updated the Issue as of now, Windows Defender flags the WandEnhancer as a Trojan the second we launch the app.

[bpmcgill]

I am also having this same issue, downloaded this from the latest release here. However the previous version does not get flagged, and works just fine.

[k1tbyte]

It seems this is related to a self-signed certificate. Is there the same issue in versions 1.0.9.0 or 1.0.8.4?

[thatchroof]

Can confirm 1.0.9.0 does not have the same issue, have not tested 1.0.8.4

[RenTed87]

It seems this is related to a self-signed certificate. Is there the same issue in versions 1.0.9.0 or 1.0.8.4?

Tried both, and both are working fine. There are no detection from Windows Defender for both the Process and the Patch File.

[rebelarya43]

1.0.9.1 will detect EXE by Windows Defender now Trojan by Today(28-06-2026).

[Felfel111]

This repository is distributing malware. Upon executing the compiled tool, it performed a session hijacking attack (Infostealer). It successfully stole my browser session cookies and credentials, and the attacker immediately used them to log into my financial accounts (RedotPay) and attempted unauthorized transactions. Please investigate and take down this malicious repository immediately to protect other users.

[k1tbyte]

I have disabled the generation of self-signed certificates in version 1.0.9.2. The compiled .exe files will no longer be available for download from this repository either.

To avoid confusion official releases will contain release notes only.

This does not mean the project is abandoned. It only changes distribution: the source code and release notes remain available, but users are expected to build their own executable from source.

[RenTed87]

I have disabled the generation of self-signed certificates in version 1.0.9.2. The compiled .exe files will no longer be available for download from this repository either.

To avoid confusion official releases will contain release notes only.

This does not mean the project is abandoned. It only changes distribution: the source code and release notes remain available, but users are expected to build their own executable from source.

So going forward, whenever there a new version we will need to Fork it and generate the Executable file ourselves?

Also the post above from felfel111, is this real?

[k1tbyte]

I have disabled the generation of self-signed certificates in version 1.0.9.2. The compiled .exe files will no longer be available for download from this repository either.
To avoid confusion official releases will contain release notes only.
This does not mean the project is abandoned. It only changes distribution: the source code and release notes remain available, but users are expected to build their own executable from source.

So going forward, whenever there a new version we will need to Fork it and generate the Executable file ourselves?

Also the post above from felfel111, is this real?

If you already created a fork, you do not need to fork again. Just sync your fork with this repository and rerun the 'Build executable' workflow in your fork.

About that malware claim: I cannot verify what file they actually ran. It is possible they downloaded a fake executable from another third-party source. The old official executable can also be inspected with tools like dotPeek if you want to verify what it does.

This kind of confusion is exactly why I am stopping public executable releases.

[RenTed87]

Sounds good.

Also, i would include a Link to your "How to Use" guide in the changelog of your latest update. Not everyone knows how to do this on Github.

For those who follow this, this is the How to Use guide the Owner made: https://github.com/k1tbyte/Wand-Enhancer#-how-to-use