Ngrok falsely detected as malware (Cassiopeia 2025-05-22)

IntLoopback0

Hey Support,

This afternoon I installed ngrok v3.22.1 via Homebrew on macOS:

% brew install ngrok
==> Downloading https://formulae.brew.sh/api/formula.jws.json
==> Downloading https://formulae.brew.sh/api/cask.jws.json
==> Caveats
To install shell completions, add this to your profile:
  if command -v ngrok &>/dev/null; then
    eval "$(ngrok completion)"
  fi

==> Downloading https://raw.githubusercontent.com/Homebrew/homebrew-cask/.../ngrok.rb
######################################################################## 100.0%
==> Downloading https://bin.equinox.io/a/kwPxkptNrPv/ngrok-v3-3.22.1-darwin-amd64.zip
Already downloaded: /Users/roble/Library/Caches/Homebrew/downloads/...--ngrok-v3-3.22.1-darwin-amd64.zip
==> Installing Cask ngrok
==> Purging files for version 3.22.1,kwPxkptNrPv,a of Cask ngrok
Error: Operation not permitted @ rb_sysopen - /private/tmp/homebrew-unpack-20250522-2132-fd20l9/ngrok

This same binary was running without issue this morning, but now F-Secure has quarantined/blocked it immediately after the Cassiopeia 2025-05-22_rp definitions (received at 17:48:12).

I’m confident this is a false positive:

• Binary source: Official ngrok download via Homebrew (https://bin.equinox.io)
• Signature: Valid code signature by “ngrok, Inc.”
• macOS version: 10.15.7

Request: Could someone from F-Secure Labs please review this definition update and whitelist ngrok again? I can provide SHA256 hashes or the quarantined sample if needed.

Thanks in advance!

Rob Lee

IntLoopback0

Update:

Just confirmed that the latest update (Cassiopeia 2025-05-22_wn) resolved the issue. Ngrok is no longer being flagged.

Thanks to the team for the quick response!

vanderheg

goede middag ik zit met het zelfde probleem

hoe kunnen we dit oplossen ,,

mijn naam c..leenders

mijn email adres is c.leenders8@upcmail.nl

JOnes

• This community supports only English and Finnish
• Do NOT reveal your private info in this forum needlessly (like email)

According accepted answer above you should check that MacOs and F-secure and its database updates are the latest possible.Ngrok is not flagged anymore

VBV

I cannot install Ngrok (https://ngrok.com/download/mac-os)
On Mac os using "brew install ngrok"

F-secure deletes a file during installation: Cloud.APPL/APC.Misc

I am on the latest F-Secure version and use the latest Ngrok version

pajp

https://community.f-secure.com/en/discussion/comment/143504#Comment_143504

Hi,

thank you for your report. I could reproduce the issue and I have sent the file for further analysis, I will update this thread once I hear back. You can also report false positives directly via https://www.f-secure.com/en/support/submit-a-sample?a=file (though I understand it can be tricky to get a copy of the file in this case).

pajp

Hi,

this file has now been marked as clean, click "Check for updates" and try again. You may also need to click "Reset reputation cache" in the Support tab of the product settings in case the earlier verdict is still in product cache.

Thank you for your report!