A bad Microsoft Defender signature update mistakenly detects Google Chrome, Microsoft Edge, Discord, and other Electron apps as 'Win32/Hive.ZY' each time the apps are opened in Windows.
The issue started Sunday morning when Microsoft pushed out Defender
signature update 1.373.1508.0 to include two new threat detections, including
Behavior:Win32/Hive.ZY.
"This generic detection for suspicious behaviors is designed to catch potentially malicious files. If you downloaded a file or received it through email, ensure that it is from a reliable source before opening it," reads the Microsoft
detection page for Win32/Hive.ZY.
According to
BornCity, the false positive is widespread, with users reporting on
BleepingComputer,
Twitter, and
Reddit that the detections appear each time they open their browser or an Electron app.
Even though Microsoft Defender will continuously display these detections when apps are opened, it is important to note that this is a false positive, and your device is mistakenly being detected as infected.
Microsoft has since released two new Microsoft Defender security intelligence updates, the latest being 1.373.1518.0.
While this signature update does not display Win32/Hive.ZY detections in BleepingComputer's tests, other users report that they
continue to receive false positives.
While it is usually not required, in this case, it may be helpful to reboot Windows after installing the new security intelligence update to see if it resolves the false positive.
As this issue is widespread and causing panic among Windows users worldwide, we will likely see a new update fixing the problem within a few hours, if not sooner.
At this time, there has been no formal confirmation of the issue from Microsoft.
