Is Endcord a Virus?

No — Endcord is an open-source Discord client modification, and its source code is publicly available for anyone to inspect.

We are aware that some antivirus engines may occasionally flag Endcord or its releases. We take these detections seriously, which is why we provide our source code, release information, VirusTotal reports, and explanations of known false positives publicly.

We do not ask you to blindly trust us. You can verify Endcord yourself.

---

Why does VirusTotal sometimes detect Endcord?

VirusTotal is not a single antivirus program. It aggregates results from many different antivirus engines, scanners, and analysis systems.

A detection from one or a small number of engines does not automatically prove that a file is malware.

VirusTotal itself documents that antivirus software can produce false positives, meaning legitimate files can sometimes be incorrectly classified as malicious. VirusTotal also specifically discusses the possibility of false positives among files with only a small number of detections.

This does not mean that every VirusTotal detection is a false positive. It means that the individual detection needs to be investigated rather than blindly treating the number as a final malware verdict.

You can inspect the individual engine names, detection labels, file hashes, and other available analysis information directly in the VirusTotal report.

---

Endcord is open source

One of the most important differences between Endcord and closed-source software is that the source code is publicly available.

You can inspect the code yourself and see what Endcord actually does.

There is no hidden "trust us" requirement.

If you are technically knowledgeable, you can:

• inspect the source code
• inspect the release files
• compare releases with the public source
• inspect network-related code
• inspect how Discord authentication is handled
• inspect dependencies
• analyze the executable yourself
• calculate and compare file hashes
• run the application in an isolated environment

If you find something genuinely suspicious, we want you to report it.

A legitimate security concern backed by evidence will never be treated the same way as an unsupported accusation.

---

What about the known antivirus detections?

Some Endcord releases have received detections from a small number of antivirus engines.

These detections are documented and discussed in our FAQ.

The important distinction is:

"An antivirus engine detected something" does not automatically mean "the developer intentionally included malware."

The detection should be investigated based on the actual file, detection name, behavior, and surrounding evidence.

We encourage users to examine the complete report rather than taking a screenshot of the detection count and treating it as a final verdict.

---

"But VirusTotal says it's a virus!"

VirusTotal does not work like this.

VirusTotal collects results from many different security products and displays their individual findings. It does not simply run one universal "is this malware?" test and give a final yes/no answer.

For example, a report may contain:

That means two participating engines reported a detection. It does not mean that 70 antivirus programs independently investigated Endcord and concluded that it is malware.

The exact detection labels and the engines responsible for them matter.

VirusTotal also provides detailed reports containing individual engine results and additional analysis information.

---

Don't trust us blindly — verify it yourself

We would rather users verify Endcord than blindly trust a statement saying:

"Endcord is safe because we said so."

You can independently investigate the project using multiple sources.

1. Source code

The Endcord source code is publicly available.

View the source code on GitHub →

2. VirusTotal

You can submit the exact release you downloaded to VirusTotal and inspect every individual engine result.

3. Microsoft Defender

Microsoft provides a submission system where software developers can submit files for malware analysis, including files that they believe have been incorrectly classified.

4. Google Safe Browsing

You can independently check the Endcord website using Google's Safe Browsing Site Status tool.

Google provides this tool specifically to check whether a website has been identified as dangerous.

5. Independent analysis

If you are experienced with malware analysis, you can analyze the release yourself using static and dynamic analysis tools.

We encourage independent research.

---

What Endcord does NOT need

Endcord does not need to hide its code.

It does not need to hide what it is doing.

It does not need to tell users:

"Just trust me."

The project can be inspected publicly.

If you believe you found malicious behavior, show the evidence.

Tell us:

• which release was affected
• which file was detected
• which antivirus detected it
• the exact detection name
• what behavior you observed
• why you believe the behavior is malicious

We are happy to investigate legitimate security reports.

---

Please don't spread unsupported malware accusations

There is a major difference between:

"This file was detected by X antivirus. Here is the report. Can someone investigate this?"

and:

"ENDCORD IS A RAT, DON'T DOWNLOAD IT!!!"

The first is a legitimate security concern.

The second is an unsupported accusation unless actual evidence is provided.

We do not prohibit criticism of Endcord. You are free to dislike the project, criticize its code, criticize its design, or report security concerns.

What we ask is simple:

---

Transparency is the goal

Endcord is an open-source project.

We believe users should be able to make their own informed decisions instead of relying on either:

• "Trust the developers."
• "Someone on TikTok said it's a RAT."

Look at the source.

Look at the release.

Look at the complete security reports.

Look at the behavior.

Make your own decision.