MS Defender triggering on install-tl-windows executable

Hi there, we are assisting a faculty member in installing the latest version of TeX Live. In doing so, Microsoft Defender is blocking it stating: "'Wacatac' malware was prevented".  I was able to download the zip file and it did not trigger a malware alert and we will attempt to proceed through that method.

With the recent supply chain attacks in the news lately, I'm reaching out for your awareness, but also checking to confirm with you that this may be a false positive? I see there were similar discussions in 2023 in the lists about the same malware name. Trojan in install-tl-windows.exe reported by Windows Defender - tex-live mailing list - TeX Users Group<http://ns2.tug.org/pipermail/tex-live/2023-June/049270.html> The mirrors we  the executable was blocked from was ctan.math.utah.edu and mirrors.rit.edu.


[cid:207d0882-6038-4e1f-aa78-de662afcbd8c]


[cid:78ab5bd3-6f7e-4cb7-a02a-bc083fb89aca]

GARRETT STEVENS, Ed.D.

Cybersecurity Engineer

Network & Computer Services

Black Hills State University



P: 605.642.6069 | E: [email protected]<mailto:[email protected]>

www.BHSU.edu<http://www.bhsu.edu/>