PyInstaller version 4.3 is resulting in exe's being removed on Windows 10 for Trojan:Win32/Wacatac.B!ml

[Go1den]

Description of the issue

When compiling my application with PyInstaller 4.3, Windows is immediately removing the executable, claiming it is a Trojan called Trojan:Win32/Wacatac.B!ml. I have tried both --onefile and --onedir compilation, and neither works. Previous versions compiled just fine. What is causing PyInstaller executables to be flagged as a trojan on Win10?

Context information (for bug reports)

• Output of pyinstaller --version: 4.3
• Version of Python: 3.9
• Platform: Windows 10
• Did you also try this on another platform? Does it work there?
  No, my app is only for Windows 10.

[rokm]

What is causing PyInstaller executables to be flagged as a trojan on Win10?

Malware authors using PyInstaller to build their trojans. (Combined with over-zealous machine learning on part of AV engines).

[bwoodsend]

The reason that this is happening only on the latest PyInstaller is because the cycle of PyInstaller users reporting false positives to MS Defender Services -> MS Defender memorises the new bootloaders baked into PyInstaller built programs and adds it to its whitelist -> that whitelist gets put into a security update -> you install said update on your machine (probably automatically). This happens every new release...

Given that it's demonstrated that it is nothing more than a big cache of checksums (just much less efficient), I generally recommend that you turn MS Defender off.