Ngrok falsely detected as malware (Cassiopeia 2025-05-22)

IntLoopback0
IntLoopback0 Posts: 6 Explorer
in Device Protection

Hey Support,

This afternoon I installed ngrok v3.22.1 via Homebrew on macOS:

% brew install ngrok
==> Downloading https://formulae.brew.sh/api/formula.jws.json
==> Downloading https://formulae.brew.sh/api/cask.jws.json
==> Caveats
To install shell completions, add this to your profile:
  if command -v ngrok &>/dev/null; then
    eval "$(ngrok completion)"
  fi

==> Downloading https://raw.githubusercontent.com/Homebrew/homebrew-cask/.../ngrok.rb
######################################################################## 100.0%
==> Downloading https://bin.equinox.io/a/kwPxkptNrPv/ngrok-v3-3.22.1-darwin-amd64.zip
Already downloaded: /Users/roble/Library/Caches/Homebrew/downloads/...--ngrok-v3-3.22.1-darwin-amd64.zip
==> Installing Cask ngrok
==> Purging files for version 3.22.1,kwPxkptNrPv,a of Cask ngrok
Error: Operation not permitted @ rb_sysopen - /private/tmp/homebrew-unpack-20250522-2132-fd20l9/ngrok

This same binary was running without issue this morning, but now F-Secure has quarantined/blocked it immediately after the Cassiopeia 2025-05-22_rp definitions (received at 17:48:12).

I’m confident this is a false positive:

  • Binary source: Official ngrok download via Homebrew (https://bin.equinox.io)
  • Signature: Valid code signature by “ngrok, Inc.”
  • macOS version: 10.15.7

Request: Could someone from F-Secure Labs please review this definition update and whitelist ngrok again? I can provide SHA256 hashes or the quarantined sample if needed.

Thanks in advance!

Rob Lee

Like Awesome

Accepted Answer

  • IntLoopback0
    IntLoopback0 Posts: 6 Explorer
    Answer ✓

    Update:

    Just confirmed that the latest update (Cassiopeia 2025-05-22_wn) resolved the issue. Ngrok is no longer being flagged.

    Thanks to the team for the quick response!

    2Like Awesome

Answers

  • vanderheg
    vanderheg Posts: 1 New Member

    goede middag ik zit met het zelfde probleem

    hoe kunnen we dit oplossen ,,

    mijn naam c..leenders

    mijn email adres is c.leenders8@upcmail.nl

    Like Awesome
  • JOnes
    JOnes Posts: 1,384 Forum Legend
    • This community supports only English and Finnish
    • Do NOT reveal your private info in this forum needlessly (like email)

    According accepted answer above you should check that MacOs and F-secure and its database updates are the latest possible.Ngrok is not flagged anymore

    Like Awesome
  • VBV
    VBV Posts: 1 New Member
    edited June 10

    I cannot install Ngrok (https://ngrok.com/download/mac-os)
    On Mac os using "brew install ngrok"

    F-secure deletes a file during installation: Cloud.APPL/APC.Misc

    I am on the latest F-Secure version and use the latest Ngrok version


    Like Awesome
  • pajp
    pajp Posts: 135 F-Secure Employee
    https://community.f-secure.com/en/discussion/comment/143504#Comment_143504

    Hi,

    thank you for your report. I could reproduce the issue and I have sent the file for further analysis, I will update this thread once I hear back. You can also report false positives directly via https://www.f-secure.com/en/support/submit-a-sample?a=file (though I understand it can be tricky to get a copy of the file in this case).

    Rasmus Sten

    F-Secure Technology, Mac Team

    1Like Awesome
  • pajp
    pajp Posts: 135 F-Secure Employee

    Hi,

    this file has now been marked as clean, click "Check for updates" and try again. You may also need to click "Reset reputation cache" in the Support tab of the product settings in case the earlier verdict is still in product cache.

    Thank you for your report!

    Rasmus Sten

    F-Secure Technology, Mac Team

    1Like Awesome

Categories