AutoHotkey malware or false positive is a context question, not a yes-or-no label. AutoHotkey is a legitimate Windows automation tool, and the official installer or a script you wrote yourself can trigger antivirus warnings. But attackers also abuse AutoHotkey scripts and compiled AHK executables, so the safe answer depends on where the file came from, what it does, and whether the alert appears again after cleanup.
If you downloaded AutoHotkey_2.0.19_setup.exe from the official project release and its hash matches the published release hash, a single detection is more likely to be a false positive. If the file arrived from a crack, Discord or Telegram upload, unknown mirror, fake update page, or you found an AHK executable running without installing it, treat it as suspicious until you verify it.
What AutoHotkey Is
AutoHotkey, often shortened to AHK, is a free scripting language for Windows automation. People use it for hotkeys, text expansion, window management, accessibility shortcuts, and small productivity tools. A clean script can send keystrokes or mouse clicks because that is exactly what automation requires.
Those same capabilities explain the alerts. Security tools look for behaviors such as keyboard hooks, script execution, packed or compiled executables, process launching, file writes, startup persistence, and network activity. A harmless macro and a malicious loader can share some surface behaviors, so antivirus engines may flag AutoHotkey files heuristically before they know the full context.
Quick Decision Table
| What you see | Risk and what to do |
|---|---|
| The installer came from the official AutoHotkey release page, the SHA256 hash matches, and only one or two engines complain. | Likely false positive. Keep it quarantined while you verify the hash, update security definitions, and submit the file to the vendor if needed. |
A compiled .exe was made from your own script and the source is simple and readable. |
Possible false positive. Avoid packing or obfuscation, share the script source when practical, and scan before restoring if the file was already blocked. |
| The AHK file came from a crack, cheat, modpack, unofficial mirror, email attachment, Discord upload, or fake update page. | High risk. Do not restore it. Remove the file, scan the system, and check accounts if it ran. |
You did not install AutoHotkey, but AutoHotkey.exe, an AHK script, or a compiled AHK executable appears in Startup, Task Scheduler, %TEMP%, or %APPDATA%. |
Suspicious. Check persistence, parent process, download history, and related files before deleting random components. |
How To Verify The Official AutoHotkey Installer
For AutoHotkey_2.0.19_setup.exe, the official GitHub release lists this SHA256 hash for the setup file: FD55129CBD356F49D2151E0A8B9662D90D2DBBB9579CC2410FDE38DF94787A3A. If your file has a different hash, do not assume it is the same installer.
- Download AutoHotkey only from the official AutoHotkey website or the official GitHub release page.
- Check the file name and version. The v2 installer normally uses a name like
AutoHotkey_2.0_setup.exeor a versioned setup file. - Compare the SHA256 hash with the published release hash for that exact version.
- Look at the file path. A file in
%USERPROFILE%\Downloadsafter a direct download is less suspicious than a same-named file in%TEMP%,%APPDATA%, or a random game/mod folder. - Check other detections and behavior. A single heuristic label is different from many engines naming stealers, RATs, downloaders, or persistence behavior.
Do not whitelist an entire folder just because the name says AutoHotkey. If you decide the official installer is safe, allow that exact file after verification. Broad exclusions can hide a malicious script that uses the same interpreter later.
Why Compiled AHK Scripts Get Flagged
AutoHotkey scripts can be compiled into standalone Windows executables. That is useful for distribution, but it also means the final .exe contains an interpreter plus script resources. Security analysts often inspect compiled AHK executables by extracting embedded resources and looking for suspicious strings, URLs, process injection behavior, persistence, or credential theft logic.
A compiled AHK file deserves extra caution when the source script is unavailable, the author is unknown, the file is packed or obfuscated, or it performs actions that ordinary hotkey tools do not need. Examples include disabling security tools, creating startup tasks, downloading additional payloads, changing the hosts file, reading browser data, or calling Windows APIs for memory allocation and thread creation.
When To Treat AutoHotkey As Suspicious
Treat the alert as potentially real malware when one or more of these signs are present:
- You did not intentionally install AutoHotkey or run an AHK script.
- The file was bundled with a crack, keygen, cheat loader, trainer, fake installer, or random modpack.
- The alert points to
%TEMP%,%APPDATA%,%LOCALAPPDATA%, Startup, a browser profile folder, or a recently created hidden directory. - Task Scheduler, Services, or
HKCU\Software\Microsoft\Windows\CurrentVersion\Runlaunches the AHK file after reboot. - The script or compiled executable contacts unknown domains, drops another executable, edits Defender settings, or adds exclusions.
- Passwords, browser sessions, Discord, Steam, or crypto wallets were opened after the file ran.
AutoHotkey abuse is not theoretical. Researchers have documented credential stealers and malware loaders written with or delivered through AHK. That does not make the official tool malicious, but it does mean an unknown AHK executable should be investigated like any other unknown program.
What To Do If AutoHotkey Was Detected
- Leave the file quarantined while you check the source. Do not restore it first and investigate later.
- Record the exact detection name, file path, hash, and download source.
- If it is the official installer, compare the SHA256 hash with the matching release page and update your antivirus definitions.
- If it is your own compiled script, scan the source script, remove unnecessary packing or obfuscation, and submit the file to the detecting vendor as a possible false positive.
- If it came from an unknown source, delete the file and check Startup, Task Scheduler, Services, browser extensions, and recent downloads.
- If the file ran, change passwords from a clean device for accounts opened after execution, especially browser, email, Discord, Steam, and financial accounts.
If an AutoHotkey alert returns after reboot, or the file came from a crack, fake installer, unknown modpack, or suspicious download, the visible AHK file may not be the only problem. A loader, scheduled task, startup entry, browser change, or bundled module can recreate the warning after you delete the first file.
A false positive is possible, but restore only after checking that the system has no companion detections, startup entries, scheduled tasks, or hidden files tied to the same source.
Scan before restoring this AHK fileIf You Wrote The AutoHotkey Script
False positives are common enough that script authors should plan for them. Keep the script readable, avoid unnecessary packers, avoid hiding the source from users who need to trust the file, and publish hashes for releases. If a vendor blocks your file incorrectly, submit the exact file and context through that vendor’s false-positive channel instead of telling users to disable protection globally.
If you need to distribute a compiled script inside an organization, document what the script automates, where it installs, whether it uses Startup or Task Scheduler, and which network destinations it contacts. That makes it easier for security teams to distinguish a business macro from a suspicious loader.
FAQ
Is AutoHotkey itself a virus?
No. AutoHotkey is a legitimate Windows automation language. The risk comes from unknown scripts, compiled AHK executables, and malicious bundles that abuse the same automation capabilities.
Can AutoHotkey_2.0.19_setup.exe be a false positive?
Yes. If it came from the official release and the SHA256 hash matches FD55129CBD356F49D2151E0A8B9662D90D2DBBB9579CC2410FDE38DF94787A3A, a small number of heuristic detections is more consistent with a false positive than a confirmed infection.
Should I restore a quarantined AHK file?
Restore it only after verifying the source, hash, path, and behavior. Do not restore an AHK file from a crack, cheat, fake update, email attachment, or unknown chat upload.
Why do antivirus tools dislike compiled AHK scripts?
Compiled AHK executables can bundle automation logic into one .exe. That can look similar to malware packaging, especially when the script is packed, obfuscated, downloads files, modifies startup settings, or uses keyboard and Windows API functions.
What if AutoHotkey keeps coming back after I delete it?
Check Startup folders, Task Scheduler, Services, browser extensions, and Run registry keys. A repeating alert usually means another component is reinstalling or launching the file.
References
- AutoHotkey project. “Release v2.0.19.” GitHub, January 25, 2025, accessed June 24, 2026. https://github.com/AutoHotkey/AutoHotkey/releases/tag/v2.0.19
- Microsoft Q&A. “Is this a virus? (AUTOHOTKEY).” Microsoft Learn, January 23, 2025, accessed June 24, 2026. https://learn.microsoft.com/en-us/answers/questions/2149855/is-this-a-virus-%28autohotkey%29
- Hive Security. “AutoHotkey Malware Loaders: How Attackers Weaponize Automation Scripts.” Hive Security, May 7, 2026, accessed June 24, 2026. https://hivesecurity.gitlab.io/blog/autohotkey-malware-loader-attack-detect/
- NVISO Labs, Nicholas Dhaeyer. “The SOC Toolbox: Analyzing AutoHotKey compiled executables.” NVISO Labs, July 20, 2023, accessed June 24, 2026. https://blog.nviso.eu/2023/07/20/the-soc-toolbox-analyzing-autohotkey-compiled-executables/
