Skip to main content
hereisjavi
May 28, 2025 9:41 PM UTC
Solved

Virus Alert from Forticlient

I was using 1password for my work computer and for the first time ever i got a virus alert for 1password from forticlient vpn. Not sure if anything has changed for this to have been triggered. 

 

1P_Dave
1P_DaveAnswer
1Password Employee
Jun 2, 2025 7:49 PM UTC

@hereisjavi and @TDMayo 

Thanks for your patience. Our release team reported this as a false positive to FortiClient and their team has confirmed that they've fixed the issue with "AVDB version 93.03495 and above". 

Please update to the latest version of FortiClient that includes this AVDB version (or later). If you still see the same message then let me know which version of FortiClient you're using so that I can bring that back to the team. 

-Dave

View in thread

5 replies

1P_Dave
1Password Employee
1P_Dave
1Password Employee
May 29, 2025 1:47 PM UTC

Hello @hereisjavi! 👋

I'm sorry that you're seeing a virus warning on your Mac. I'm not currently seeing any other reports of this from other customers, since you're using a work machine I recommend that you reach out to your employer's IT team so that they can look into this further from their end and make sure that your Mac is secure.

If they determine that the issue isn't limited to just your Mac, please open a ticket with our support team by sending an email to support@1Password.com along with a link to this thread.

After emailing in, you'll receive a reply from BitBot, our friendly robot assistant with a Support ID that looks something like [#ABC-12345-678]. Post that here, and I'll be able to locate your message and make sure it's gotten to the right place. 🙂

-Dave

TDMayo
May 30, 2025 8:34 AM UTC

Good morning,


We use 1PW and Forticlient in our estate and have seen the same for 1PW for Mac.


User is running 1Password for Mac 8.10.78


I have access to the Forti estate and this is the info I see related to the actions taken;

"Malware:PossibleThreat/170896788 in /Applications/1Password.app/Contents/XPCServices/OP Updater Service.xpc/Contents/MacOS/OP Updater Service found by realtime scan. Quarantine success"



I'm seeing this hit a number of hosts in the estate (All MacOS), so it does appear to warrant investigation.

I've asked one of my users to manually update via the stable release website to test if it allows updating via that method.

Many thanks

TDMayo
May 30, 2025 8:42 AM UTC

Just to note I've also raised this with support - [#WDG-19859-579]

1P_Dave
1Password Employee
1P_Dave
1Password Employee
May 30, 2025 8:45 PM UTC

@TDMayo 

I'm sorry that you're seeing a similar issue. Thank you for posting the Support ID. I've replied to your email, let's continue the conversation there.

-Dave

1P_Dave
1Password Employee
1P_DaveAnswer
1Password Employee
Jun 2, 2025 7:49 PM UTC

@hereisjavi and @TDMayo 

Thanks for your patience. Our release team reported this as a false positive to FortiClient and their team has confirmed that they've fixed the issue with "AVDB version 93.03495 and above". 

Please update to the latest version of FortiClient that includes this AVDB version (or later). If you still see the same message then let me know which version of FortiClient you're using so that I can bring that back to the team. 

-Dave

Terms & ConditionsAccessibility statement

©2026 1Password. All rights reserved.
4711 Yonge St, 10th Floor, Toronto Ontario, M2N 6K8, Canada