New Korg Trinity Trojan Warning on Install?

[DevonB]

When I attempt to install the Korg Trinity, I'm getting a Trojan:Script/Wacatac.B!ml warning and quarantine right after downloading it from the new 1.3.9 Korg Software Pass installer. Anyone else getting this? I'm on Windows 11 24H2 with just build in Windows virus scanning, no 3rd party products.

Devon

[Ah_Dziz]

Plugin installers often trigger false positives. Try other online malware detectors to rule out a real infected file. Also try to redownload. I'm sure korg isn't knowingly distributing malware.

[tumface]

No warning here. The "!ml" postfix means it's probably a "machine learning" (AI...) virus detection method, which are notoriously inaccurate.

[DevonB]

Plugin installers often trigger false positives. Try other online malware detectors to rule out a real infected file. Also try to redownload. I'm sure korg isn't knowingly distributing malware.

Ya, I wouldn't think Korg would be malicious intent with their content, but it's brand new as of today, and something accidental is certainly possible. I'll have to find another scanner as I don't want anything additional on my DAW outside of Windows Security. I have downloaded it now 4 times, same results.

Devon

[DevonB]

No warning here. The "!ml" postfix means it's probably a "machine learning" (AI...) virus detection method, which are notoriously inaccurate.

Ya, I'm guessing it's a false positive too, but it's brand new out today, and anything is possible. If it had been out a month or two and I saw that, I'd just consider it a false positive.

Devon

[DevonB]

I got a response from Korg. Looks like they are aware of it. Here's what they said -

KORG app (KORG app User Community)

Oct 29, 2025, 09:22 GMT+9

Hello.

Thank you for contacting us and sorry for the inconvenience.
Sometimes new installers can generate False positives in the Windows Defender.

We have already submitted it to Microsoft for inclusion in the while list,
could you let us know if you are still facing problems?
It is possible to add it as a security exception inside Windows Defender,
but we are expecting it to be soon solved in

Thank you in advance.

Best regards,

KORG App Team

I did scan it with Microsoft Security after I allowed it through, as well as ran Trend Micro House Call and both came up with nothing. Got it installed and works just fine.

Devon

[SonicBlue555]

Same here, but it got triggered only on my Windows 11 25H2 Laptop (on Desktop I still got 24H2).
I did a Virustotal scan yesterday, and came out completely clean, must be a false positive:

Virustotal Trinity Result

[Caine123]

good to know, still i will wait until it is whitelisted. did anyone check it with virus total too?

[SonicBlue555]

good to know, still i will wait until it is whitelisted. did anyone check it with virus total too?

Check my previous post

[DevonB]

dbl post

[DevonB]

dbl post.

[osiris]

This reminds me of the old Synthedit bug, and I think it could be triggered by the Korg trying to 'phone home'. At least that's what the SE issue was. Better safe than sorry.

[Caine123]

This reminds me of the old Synthedit bug, and I think it could be triggered by the Korg trying to 'phone home'. At least that's what the SE issue was. Better safe than sorry.

you mean the issue got resolved later?

[thecontrolcentre]

Same problem here ... WIN Defender was deleting the downloaded exe. (detected as a Trojan) as soon as it downloaded via KORG Software Pass (before installation), but after about half a dozen attempts the file eventually downloaded and installed correctly I did a system scan after installing, and there were no issues found.

[Caine123]

still strange, even with false positives you think a company like Korg checks this before, I'm gonna wait.