Image provided to ZDNet by a reader
Microsoft Defender Advanced Threat Protection (ATP), the commercial version of the ubiquitous Defender antivirus and Microsoft’s best enterprise security solution, is having a bad day and labeling yesterday’s Google Chrome browser update as a backdoor Trojan horse.
Detections, as seen in the image above shared with ZDNet by one of our readers, are for Google Chrome 88.0.4324.146, the latest version of the Chrome browser, which Google launched last night.
As per the screenshot above, but also based on reports shared on Twitter by other discouraged system administrators, Defender ATP is currently detecting several files that are part of the Chrome update package v88.0.4324.146 as containing a backdoor trojan generic called “PHP / Funvalget. UMA.”
The alerts have caused quite a stir in corporate environments due to the recent multiple attacks on the software supply chain that have hit companies worldwide in recent months.
System administrators are currently awaiting a formal statement from Microsoft to confirm that the detection is a “false possibility” and not a real threat.
ATP is being triggered in C: Program Files (x86) Google Chrome Application 88.0.4324.146 Locales sk.pak
– Dark Defender (@ShadyDefender) February 3, 2021
Hey @msftsecresponse – I see many Defender ATP alerts this morning in C: Program Files (x86) Google Chrome Application 88.0.4324.104 Locales sl.pak detected as PHP / Funvalget.A. Can you confirm that this is a false positive? SHA256 in response.
– W. David Winslow (@wdwinslow) February 3, 2021
Defender detected sl.pak as ‘Backdoor: PHP / Funvalget.A’
C: Program Files Google Chrome Application 88.0.4324.146 Locales sl.pak
Defender detected chrome.7z as ‘Backdoor: PHP / Funvalget.A’
C: Program Files Google Chrome Application 88.0.4324.146 Installer chrome.7z– itquartz (@itquartz) February 3, 2021
ZDNet contacted a Microsoft spokesperson prior to the publication of this article, seeking a formal statement on ATP detections.
Chances are that this is really an erroneous detection, but until a formal announcement is made, administrators are advised to wait before taking further action.
The free version of Microsoft Defender antivirus, which ships with all recent versions of Windows, did not detect the recent Chrome update as malicious, according to several ZDNet tests.
Updated at 15:55 ET to add that Microsoft confirmed that today’s Funvalget detections for Chrome files were false positive detections due to “an automation error”