FileZilla is a legitimate file-transfer application, but the exact installer and where you obtained it matter. An official offer-enabled installer can include optional bundled software and trigger a potentially unwanted application (PUA) alert. That is a different situation from a modified copy downloaded from a fake site. Check the source, package and signature before deciding whether to keep a download; do not disable antivirus protection merely to run it.
Three different FileZilla download situations
| Package or source | What the warning may concern | What to verify |
|---|---|---|
| A package obtained directly from the official project | The particular file, version or packaging, rather than the FileZilla name alone | The actual download address, package type and signature. Use the project’s listed download options. |
| An official sponsored or offer-enabled installer | Bundled offers classified as potentially unwanted | Each offer presented during setup and whether you accepted additional software. A valid signature does not make every offer desirable. |
| An unofficial archive or lookalike download site | A modified package or malicious additional component | The source and archive contents. A familiar FileZilla executable does not authenticate every DLL beside it. |
FileZilla’s own guidance describes the sponsored offers as optional and says users can decline them. Microsoft separately lists PUABundler:Win32/FileZilla_BundleInstaller as a Defender detection. The name identifies a bundler classification; Microsoft’s public entry does not provide detailed technical behavior for every installer. Do not turn it into a claim that all FileZilla versions steal passwords, or assume that every alert is harmless.
Check your exact installer without running it
- Start from the official FileZilla Client download options. Check the hostname carefully rather than trusting an advertisement or the page’s logo. Choose the package appropriate for your system and inspect whether it includes offers.
- On Windows, right-click the downloaded installer and open Properties → Digital Signatures if that tab is available. Inspect the signer and certificate details. A missing tab, invalid signature or unexpected signer needs investigation; do not use a filename as a substitute.
- Keep the filename, version, source and SHA-256 hash together when comparing a scan report. Reports for a different version or package do not describe your download. A valid signature establishes signer/integrity information, not a universal safety verdict.
- If a security tool blocks the file, leave it quarantined while you review the exact alert or obtain another package from the official source. Do not add a blanket exclusion for your Downloads folder.
For a concrete example, the Gridinsoft report for FileZilla_3.70.6_win64_sponsored2-setup.exe showed 3/62 detections when checked on October 25, 2026, including the FileZilla bundler label. That is a report about one hash, not all FileZilla downloads. The count alone does not prove that a computer was infected or explain an unexpected restart.
A fake download is a separate threat
In March 2026, Malwarebytes documented a modified FileZilla 3.69.5 archive distributed through a lookalike site. It included an added version.dll that the legitimate application loaded when launched. The report described credential-theft risk through DLL sideloading; it did not attribute the attack to the official project’s sponsored installer.
This distinction matters when someone says “the executable was signed.” A genuine executable can be packaged beside an unwanted library. Do not download a replacement DLL or launch an unfamiliar archive to see whether the program opens normally. Normal-looking behavior is not sufficient verification.
What to do after downloading or installing
- Downloaded only: leave a detected installer quarantined or delete an unwanted download. Downloading a file is different from executing it; do not assume your saved server credentials were stolen solely from this event.
- Ran an official installer and declined the offers: review what was actually installed and the exact warning. A bundler detection alone does not establish a separate trojan infection. Investigate any unexpected app or browser change.
- Accepted an unwanted offer or have persistent symptoms: review recently installed apps and browser extensions, then use the scan-and-cleanup route below.
- Windows restarted or the installation failed: note the time, error and package version. An unexpected restart needs troubleshooting; it is not enough to identify malware or blame the installer without further evidence. Do not repeatedly rerun a blocked file.
- Ran a modified or untrusted archive: stop using that installation for server logins, scan the device, and consider the credentials accessible to it. If credential exposure is confirmed or plausible from the executed threat, rotate the affected FTP/SFTP, hosting or related passwords from a trusted device and review server access logs.
Check for unwanted components on Windows
If you installed an unwanted offer, ran an unofficial package or still see suspicious changes, download and install Gridinsoft Anti-Malware, update it and run a Full Scan. Review the detections, apply cleanup to the unwanted items you select, and restart if prompted. This is the main cleanup route; it does not require a second mandatory sequence of manual file and registry deletion.
Scan Windows after an unwanted bundled offer, suspicious unofficial package or persistent symptom. Review detections before applying cleanup.
Download Gridinsoft Anti-Malware for WindowsAfter restarting, check whether the unexpected apps, browser changes or alerts return. Save the report for support if they do. Use the post-malware Windows audit for a confirmed compromise. Account recovery and a review of affected hosting systems remain separate from cleaning the local computer.
References
- FileZilla Pro. Is FileZilla Safe? Security & Malware Check 2026. FileZilla Pro Knowledge Base. Accessed October 25, 2026.
- Microsoft. PUABundler:Win32/FileZilla_BundleInstaller. Microsoft Security Intelligence. October 11, 2021. Accessed October 25, 2026.
- Dasic, S. A fake FileZilla site hosts a malicious download. Malwarebytes. March 2, 2026.
