Skip to main content
May 28, 2025
Solved

Virus Alert from Forticlient

  • May 28, 2025
  • 3 replies
  • 251 views

I was using 1password for my work computer and for the first time ever i got a virus alert for 1password from forticlient vpn. Not sure if anything has changed for this to have been triggered. 

 

Best answer by 1P_Dave

@hereisjavi and @TDMayo 

Thanks for your patience. Our release team reported this as a false positive to FortiClient and their team has confirmed that they've fixed the issue with "AVDB version 93.03495 and above". 

Please update to the latest version of FortiClient that includes this AVDB version (or later). If you still see the same message then let me know which version of FortiClient you're using so that I can bring that back to the team. 

-Dave

3 replies

1P_Dave
1Password Employee
May 29, 2025

Hello @hereisjavi! 👋

I'm sorry that you're seeing a virus warning on your Mac. I'm not currently seeing any other reports of this from other customers, since you're using a work machine I recommend that you reach out to your employer's IT team so that they can look into this further from their end and make sure that your Mac is secure.

If they determine that the issue isn't limited to just your Mac, please open a ticket with our support team by sending an email to support@1Password.com along with a link to this thread.

After emailing in, you'll receive a reply from BitBot, our friendly robot assistant with a Support ID that looks something like [#ABC-12345-678]. Post that here, and I'll be able to locate your message and make sure it's gotten to the right place. 🙂

-Dave

May 30, 2025

Good morning,


We use 1PW and Forticlient in our estate and have seen the same for 1PW for Mac.


User is running 1Password for Mac 8.10.78


I have access to the Forti estate and this is the info I see related to the actions taken;

"Malware:PossibleThreat/170896788 in /Applications/1Password.app/Contents/XPCServices/OP Updater Service.xpc/Contents/MacOS/OP Updater Service found by realtime scan. Quarantine success"



I'm seeing this hit a number of hosts in the estate (All MacOS), so it does appear to warrant investigation.

I've asked one of my users to manually update via the stable release website to test if it allows updating via that method.

Many thanks

May 30, 2025

Just to note I've also raised this with support - [#WDG-19859-579]

1P_Dave
1Password Employee
May 30, 2025

@TDMayo 

I'm sorry that you're seeing a similar issue. Thank you for posting the Support ID. I've replied to your email, let's continue the conversation there.

-Dave

1P_Dave
1P_DaveAnswer
1Password Employee
June 2, 2025

@hereisjavi and @TDMayo 

Thanks for your patience. Our release team reported this as a false positive to FortiClient and their team has confirmed that they've fixed the issue with "AVDB version 93.03495 and above". 

Please update to the latest version of FortiClient that includes this AVDB version (or later). If you still see the same message then let me know which version of FortiClient you're using so that I can bring that back to the team. 

-Dave