I've been made aware of a post from someone representing Rufus who says I'm very confused about this post. I've reported that Windows Defender went bananas after I installed Rufus on a Windows 11 device. It immediately popped up warnings about hacktools and trojans being installed while it was installing. I wish I had a record of it but I nuked everything after the alerts.
Oct 24, 2026, 3:12 AM@briankrebs There are some rather ... possessive communities around USB boot image builders, I forget if it was rufus or ventoy or what, but long story short: if you badmouth the product, the sealions. Dear god, the sealions.
Oct 24, 2026, 3:48 AM@briankrebs Rufus doesn't have an installer though. That's the thing. One simply doesn't install Rufus.
Oct 24, 2026, 3:55 AM@briankrebs
I think it's worth noting, a long history of actors buying ad-space at the top of search engines.
The url in the ad appears legitimate (it's visually the legitimate URL), but when clicked goes to a different url. I'm not positive that's the case here, but it's been done 100s of times for 100s of other tools (AI tool installers, chrome installs, etc), and there is zero visual indication it's an ad directing to the wrong domain.
Thanks to LLMs, the landing pages have also gotten much better at copying the real pages too.
Making it more difficult, is that ads don't always present themselves, so seeing it a 2nd time may take 100s of visits
Or maybe it really was a compromised rufus domain🤷
Oct 24, 2026, 9:12 AMYou have 4 posts, and 25% of them are ragging on one the most respected and savvy tech journalists of all time..?
https://club.shish.org/objects/e261c240-d528-4f62-91af-acf1f32dd53f
Good job man. Really good job!
Oct 24, 2026, 5:36 AM@briankrebs i'm sorry someone actually posted that on github issues?? Oy vey..
@briankrebs Brian, I've never used Rufus before but I've looked at the executable that is downloadable from their site (the first one, rufus-4.15.exe) and I assure you that it is not malicious. It's possible that Windows Defender is throwing some kind of false positive (although simply running the executable did not produce any alerts here) but I'd need more precise information, in order to determine what exactly is happening.
Could you please document the exact steps one needs to perform, in order to reproduce your results? Which executable did you download? When did the alert pop up? What parameters did you select?
The thing's UI is awful, BTW - apparently you have to click on what looks like a dropdown listbox, in order to open a file selection menu, WTF.