Windows Defender Is Crying Wolf: The Nemucod False Positive Hitting Microsoft Teams Users Today

If your SOC dashboards lit up this morning with Defender alerts for a JavaScript trojan, you are in good company. Across our client base we began receiving notifications in volume, all pointing to the same file, the same hash, and the same detection name. Within a short investigation window it became clear this was not an outbreak — it was a misfiring antivirus signature.

This post covers what happened, why Defender is raising the alarm, what the file actually is, and precisely what you need to do (and not do) to resolve it cleanly.

What Exactly Is Being Detected?

Windows Defender is raising a threat alert under the detection name Trojan:JS/Nemucod — a well-known malware family that typically acts as a downloader, fetching ransomware or banking trojans onto victim machines. On the surface, seeing that name in an alert is understandably alarming. In this case, however, the target file is entirely benign.

This file is delivered by the Microsoft Teams auto-update mechanism — a compressed JavaScript asset that forms part of a routine Teams client update package. It originates from Microsoft's authenticated update infrastructure and is not, under any circumstances, a trojan.

Why Is Defender Flagging It?

The Nemucod trojan family is known for using compressed JavaScript files — typically delivered in ZIP or GZ archives — as its initial dropper stage. Defender's heuristic engine uses behavioural pattern matching that looks for this signature: a .js.gz file arriving via a network-delivered update mechanism.

The file looks like Nemucod to Defender's heuristics. The problem is it also looks exactly like a legitimate Teams update — because that is precisely what it is.

This is a classic false positive scenario. The heuristic is casting too wide a net: the structural similarity between a malicious Nemucod dropper and a compressed JavaScript update payload is high enough that Defender cannot distinguish them without a more specific signature. Microsoft has been notified and a corrected definition update is expected.

What Has the SOC Confirmed?

Upon receiving multiple client alerts, our team undertook immediate triage. The findings are unambiguous:

• ✓ The file was verified as originating from Microsoft's authenticated Teams update infrastructure. Delivery chain analysis showed no anomalies.
• ✓ Cross-referencing the SHA-256 hash against multiple threat intelligence platforms confirmed the file as clean across all sources.
• ✓ No malicious behaviour was observed on any affected endpoint — no command-and-control communication, no lateral movement, no payload delivery.
• ✓ Sandbox detonation of the file produced no malicious indicators whatsoever. It behaves exactly as a Teams update asset should.

What Should You Do Right Now?

Follow these steps in order. The most critical point is the first one.

• ! Do not quarantine or delete the file. Removing it will break the Microsoft Teams update process and may leave Teams clients on an outdated version.
• 1 If Defender has already quarantined the file, restore it via the Windows Security console, or run: Restore-MpThreat -ThreatID <ID> in an elevated PowerShell session.
• 2 Add the file hash d6a4b9193977c801dd8932d06c742dd7a8128d0c1e5cbfb646fe5a648ed01eb5 to your Windows Defender exclusion list to suppress repeat alerts until Microsoft issues a corrected signature.
• 3 Monitor for a Defender definition update from Microsoft that specifically addresses this false positive. Apply it via Windows Update or your endpoint management platform as soon as it is available.
• 4 Close any open incidents or tickets raised against this detection. Document them as confirmed false positives and reference bulletin FP-2026-0324-001.
• 5 Stay vigilant — this false positive applies only to the file and hash above. Any Nemucod detections against other files should still be treated as genuine alerts and investigated in full.

A Note on Alert Fatigue

False positives are one of the most corrosive forces in a SOC environment. When analysts see high volumes of alerts they have learned to distrust, the risk is real: a genuine threat gets buried in the noise. This event is a useful reminder to treat false positive confirmation with the same rigour as a true positive investigation — document it, communicate it, and use it to refine detection logic.

The right response to a false positive is not to lower your guard. It is to be precise about where and why the detection failed, fix the specific gap, and keep everything else sharp.

Summary

Windows Defender is incorrectly flagging 188161-0c062c3d04251434.js.gz (SHA-256: d6a4b9193977c801dd8932d06c742dd7a8128d0c1e5cbfb646fe5a648ed01eb5) as Trojan:JS/Nemucod. The file is a legitimate component of a Microsoft Teams update package. There is no threat. Do not quarantine it, add a targeted hash exclusion, and await a corrected Defender signature from Microsoft.

Full technical advisory bulletin reference: FP-2026-0324-001. SOC clients should quote this reference in all correspondence and when closing associated incidents.