Your safety comes first. Don't run any software, including Octopus Scanner, if you don't trust the developer, if the hash doesn't match, if an antivirus scan reports something unexpected or if you don't have permission to install software on that device. If in doubt, don't.
Microsoft Defender may flag Octopus Scanner as malware. Microsoft Defender often flags the app using machine learning (ML) detection, most commonly when it is first installed and opened or after an update. These are usually false positives: the detection is based on general patterns in how the app behaves, not on a match with any known malware. Because these decisions are made separately on each device, some people see a warning and others don't.
To help reduce these false detections, each release on the Download page is submitted to Microsoft for malware analysis and to VirusTotal. If Microsoft Defender blocks the app, see If your antivirus quarantines the file.
1. Why the app is unsigned
Windows and macOS warn about software from developers whose identity they haven't verified. Removing those warnings costs money every year. Apple requires membership of its Developer Program (£79 per year) to sign and notarise Mac apps. On Windows, code-signing certificates are sold by commercial certificate authorities and typically cost a few hundred pounds per year, and even a signed app can still trigger SmartScreen warnings until it builds up a download reputation.
Octopus Scanner is a free project by an independent developer, so it isn't signed with a verified developer certificate or notarised by Apple. When Microsoft Defender SmartScreen or Gatekeeper warns you, it isn't saying the file contains malware. It is saying that Microsoft or Apple hasn't verified who published it. That is true, which is why you should verify the file yourself before you run it.
2. Verify the file yourself
Download Octopus Scanner only from the Download page on this website. Files offered under the same name anywhere else aren't official and can't be vouched for.
Check the SHA-256 hash. The Download page publishes a SHA-256 hash beside each file. A matching hash confirms that the file you received is identical, byte for byte, to the published file, and hasn't been tampered with or corrupted in transit.
The easiest way is Check the file in the thank-you message that appears when you select Download: once the download finishes, choose or drop the file, and your browser compares its hash with the published one without uploading it. You can also check it with a command, replacing the file name with the name of your download.
- Windows (PowerShell):
Get-FileHash .\filename.exe -Algorithm SHA256 - macOS (Terminal):
shasum -a 256 filename.dmg
Text description: Terminal on a Mac showing the SHA-256 hash of the download
Example of Terminal on a Mac after running shasum -a 256 filename.dmg. The output is the file's SHA-256 hash, a 64-character code of numbers and letters, followed by the file name.
Text description: PowerShell on Windows showing the SHA-256 hash of the download
Example of PowerShell on Windows after running Get-FileHash .\filename.exe -Algorithm SHA256. The output is a table with the columns Algorithm, Hash and Path. It shows SHA256, the file's hash as a 64-character code of numbers and capital letters, and where the file is.
If the hash doesn't match, don't run the file. Delete it and email support@octopusscanner.com, because a mismatch means the file is corrupt or isn't the published file.
What a matching hash does and doesn't tell you. SHA-256 is a widely trusted standard, and there is no known practical way to create a different file with the same hash, so a match is strong evidence that your file is the one published here. It confirms the file is intact, but on its own it doesn't prove who made it: the file and its hash both come from this website, so if the website itself were ever compromised, both could be changed together.
A hash check is therefore most reliable alongside the other steps on this page, such as downloading only from this website over its secure connection. Octopus Scanner isn't code-signed, so the hash is the main way to confirm the file is genuine.
Optionally, check it with VirusTotal. VirusTotal is a free service, owned by Google, that checks files against more than 70 antivirus engines at once. You can upload the file, or paste its SHA-256 hash into the search box to see existing results without uploading anything. A clean result isn't an absolute guarantee of safety, and files you upload are shared with the security research community.
3. How to get things running
Only after you have downloaded the file from this website and confirmed that the hash matches, tell your operating system that you trust it.
Windows: Microsoft Defender SmartScreen
- On the "Windows protected your PC" message, select More info.
- Select Run anyway.
Text description: Windows protected your PC message, with Run anyway and Don't run buttons
Example of the Microsoft Defender SmartScreen message. The heading reads Windows protected your PC, followed by the text: Microsoft Defender SmartScreen prevented an unrecognised app from starting. Running this app might put your PC at risk. Below that, Publisher: Unknown publisher, then two buttons, Run anyway and Don't run.
If Windows keeps blocking the file, depending on your security settings you may need to unblock it:
- Right-click the downloaded file and select Properties.
- At the bottom of the General tab, select the Unblock checkbox, if it is shown.
- Select Apply, then run the file again.
macOS: Gatekeeper
- Try to open Octopus Scanner from your Applications folder, then close the warning. Don't move the app to the Trash.
- Open System Settings > Privacy & Security and scroll down to the Security section.
- Next to the message about Octopus Scanner, select Open Anyway.
- Enter your password if asked, then select Open.
Text description: macOS Privacy and Security settings, with an Open Anyway button for Octopus Scanner
Example of the Security section in System Settings, under Privacy and Security. Allow applications from is set to App Store & Known Developers. Below it, the message: “Octopus Scanner” was blocked to protect your Mac, with an Open Anyway button beside it.
On macOS 14 (Sonoma), you can instead Control-click Octopus Scanner in Applications, choose Open, then select Open again.
macOS says the app is "damaged"
macOS shows this message for some apps that are downloaded from the web and not notarised by Apple. Open Terminal and run the following command, adjusting the path if Octopus Scanner isn't in your Applications folder:
xattr -cr /Applications/Octopus\ Scanner.appThe app then opens normally. For anything not covered here, see the Troubleshooting Guide, or the official Microsoft and Apple support websites.
4. If your browser blocks the download
Chrome and Microsoft Edge sometimes block downloads of uncommon files with a message such as "filename.exe is not commonly downloaded and may be dangerous". This is a reputation check, not a malware detection. Small independent releases haven't been downloaded often enough to be recognised.
- Chrome: Open the Downloads panel, select the blocked item and choose Keep. You may need to select Show more first.
- Edge: Point to the download, open the … menu and choose Keep.
Then verify the hash, as described above, before you do anything else with the file.
5. If your antivirus quarantines the file
An antivirus product may quarantine the file instead of only warning you. This is usually a heuristic detection: because the file is unsigned and rarely downloaded, the antivirus flags it based on general patterns rather than a match with known malware. Detection names that contain words such as "Generic", "Heur", "Suspicious" or "ML" indicate a statistical judgement, not a confirmed threat.
Don't restore the file and run it straight away. Work through these steps in order:
- Check what was detected: Open your antivirus quarantine or history page and note the detection name.
- Check the file with VirusTotal: Look up its SHA-256 hash, or upload it. If only one or two engines out of 70 flag it with a generic name, that is the usual pattern of a false positive. If many engines flag it with a specific malware name, stop and email support@octopusscanner.com.
- Restore the file from quarantine: If your antivirus quarantines it again straight away, add an exclusion for that one file only, never for a whole drive or a folder you use for other downloads.
- Verify the hash after restoring: Quarantine and restore can occasionally corrupt a file.
- Report the detection: Email support@octopusscanner.com with the name of the antivirus product and the detection name, so the false positive can be reported to the vendor.
If anything seems wrong, such as a hash that doesn't match, a specific malware name or several engines flagging the file, trust your antivirus, delete the file and get in touch.
If your browser or SmartScreen blocks the download, try installing from the terminal instead. The command downloads the installer directly and checks its SHA-256 hash, so browser download blocks and SmartScreen prompts don't usually apply. Your antivirus still checks Octopus Scanner as it installs, so if it quarantines the app, follow the steps above.
6. Antivirus and component updates
Updating components and the Node.js runtime downloads new code and runs it on your computer. Your antivirus or security software, such as Microsoft Defender or your organisation's endpoint protection, may scan the new files, flag them or briefly block them while they install. This is expected, and on its own it doesn't mean anything is wrong.
Every component is verified against its official source before it is installed, and dependency updates are also checked for known malware, as described in How Octopus Scanner stays up to date.
If an update is slow, fails or is blocked:
- Let your security software finish: Give it time to finish checking the new files.
- Try again: Open Dependency Patching or Node Runtime and install the update again. An update that fails a check is discarded, and your current components keep working.
- Add an exception only if your organisation's policy allows it: On a work computer, ask your IT or security team instead of changing the settings yourself.
If your security software reports a specific malware name, don't try again. Email support@octopusscanner.com with the product and detection name.
If anything misbehaves after an update, select Revert in Preferences > Options > Advanced, then restart. Revert returns to the components this version shipped with.
Using a work computer? Organisations often configure their security systems to block unsigned software automatically, by design. Don't try to work around those controls. To use Octopus Scanner on a work computer, ask your IT or security team whether they can approve an exception.
7. Related guides
- The Install Guide covers the standard installer, updates and removal.
- The Terminal Install Guide installs Octopus Scanner with one command that checks the download for you.
- Security Policy explains how to report a security problem.
Was this page helpful? Email your feedback about Security Warnings Guide.