Malware Detection

[ahmadzahran2002]

I am writing to raise a concern regarding the security of the Wand Patcher. When attempting to use or install the file, it was flagged by security software as a high-level threat.

While I understand that "patchers" often trigger false positives because they modify memory or files, the specific behavior and the alert from the antivirus suggest this might be more than a typical false flag.

Evidence / Observation

• Detection Type: [Insert Antivirus Name, e.g., Windows Defender]
• Threat Label: [Insert Label, e.g., Trojan:Win32/Bladabindi]
• Behavior: [Describe what happened, e.g., "The file was automatically quarantined"]

Request for Clarification
Can the maintainers or community provide:

1. A VirusTotal scan link for the latest release?
2. An explanation of why these specific flags are appearing?
3. Confirmation if the source code for the .exe is fully open and audited?

Warning
To other users: Please be careful and run this in a Virtual Machine (VM) or Sandbox until its safety is confirmed. Better safe than sorry.

[byd228]

did you retry to download it or have you done some tets with the latest WeHand to see if it was good or you're still waiting for the author to put a link with the VirusTotal scan link ? if it's safe tell me

[blockycraftparty]

while it does work as its meant to, it is malware and it secretly downloads some weird shit and it got my discord and microsoft accounts hacked

[k1tbyte]

while it does work as its meant to, it is malware and it secretly downloads some weird shit and it got my discord and microsoft accounts hacked

What are you talking about? If you built it yourself, show the commit SHA and the URL/domain it supposedly downloaded from.

WandEnhancer does not steal Discord/Microsoft sessions or ANY data. If the source code did that, GitHub would have taken the repo down already.

There are no official .exe downloads anymore, so third-party binaries are not from this project.

[blockycraftparty]

i had an older download that was an exe so it probably was messed with by someone else

[HalninC]

+1 to what k1t said, blocky either downloaded weird stuff or they are just being stupid. Even if you review the files the only URL/domain endpoint is this repo lol