Is Hookshot a virus?

The maintainer identifies the reported Windows Defender detections as false positives. The evidence and discussion are collected in issue #1003. This documentation has not independently audited the release binaries.

Why does Defender flag it?

Windows Defender can flag or quarantine HookshotBuilder.exe as Trojan:Script/Wacatac.H!ml. The maintainer explains that !ml denotes a machine-learning detection and that new, unsigned executables can trigger it. The thread also contains reports of other detection names.

A detection name alone does not establish whether a particular download is safe. Use the official releases and review the linked reports.

Is it signed?

As checked on November 10, 2026, the maintainer says they have applied for code signing through SignPath and the builder is not yet signed. Follow #1003 for updates.

Can I inspect it or build it myself?

Yes. Hookshot is open source. You can review the code and follow the development guide to build from source if you prefer that to the provided binaries. Source availability makes review possible; it is not itself a security audit.