🐛Windows Defender marking cloudflared 2025.9.1 as Trojan:Win32/Kepavll!rfn

[ondruska]

Steps to reproduce the behavior:

1. Install the cloudflared 2025.9.1 on Windows 11 with Defender.
2. Do a scan.
3. Executable will be marked as severe threat Trojan:Win32/Kepavll!rfn

Environment and versions

• OS: Windows 11 24H2
• Architecture: AMD64
• Version: 2025.9.1

This behavious verified across different computers with different Defender (both consumer and corporate).

[ericcross]

Same issue on Windows Server 2019 Datacenter (v 1809). Installed the update yesterday and today it was flagged in a scan and the windows service and exe file were removed.

[ondruska]

Just a note what I have done from my side:

1. submitted as false positive at https://www.microsoft.com/en-us/wdsi/filesubmission
2. temporarily excluded with Add-MpPreference -AttackSurfaceReductionOnlyExclusions ( Join-Path ${Env:ProgramFiles(x86)} cloudflared/cloudflared.exe )

[gabealex27]

Just a note what I have done from my side:

1. submitted as false positive at https://www.microsoft.com/en-us/wdsi/filesubmission
2. temporarily excluded with Add-MpPreference -AttackSurfaceReductionOnlyExclusions ( Join-Path ${Env:ProgramFiles(x86)} cloudflared/cloudflared.exe )

May you please help me with instructions or something on how you temporarily excluded it? I would really appreciate it and thank you in advance

[ondruska]

May you please help me with instructions or something on how you temporarily excluded it? I would really appreciate it and thank you in advance

Use elevated privileges to run following PowerShell command, given the standard MSI install location of cloudflared:

Add-MpPreference -AttackSurfaceReductionOnlyExclusions ( Join-Path ${Env:ProgramFiles(x86)} cloudflared/cloudflared.exe )

[gabealex27]

May you please help me with instructions or something on how you temporarily excluded it? I would really appreciate it and thank you in advance

Use elevated privileges to run following PowerShell command, given the standard MSI install location of cloudflared:

Add-MpPreference -AttackSurfaceReductionOnlyExclusions ( Join-Path ${Env:ProgramFiles(x86)} cloudflared/cloudflared.exe )

Thanks. So after that do I just reinstall cloudflared tunnel?

[ondruska]

Thanks. So after that do I just reinstall cloudflared tunnel?

Yes, before or after, does not matter. Add-MpPreference does not check resource existence, only controls exclusions. If it does not work you may want to try using https://learn.microsoft.com/en-us/powershell/module/defender/add-mppreference?view=windowsserver2025-ps#-exclusionpath instead of -AttackSurfaceReductionOnlyExclusions, that shall work for sure.

[szczuroskoczek]

+1, can't download neither from official cloudflare nor github releases. other versions and other archs work just fine. I'd also like to add that on version 2025.9.0 SmartScreen also warns users that the publisher could not be verified before proceeding to installation