False Positive: Windows Defender flags gh as Trojan:Script/Wacatac.H!ml via Scoop install #13306

Describe the bug

When attempting to install or update the GitHub CLI using scoop on Windows 11, Windows Defender immediately blocks and quarantines the executable, flagging it as Trojan:Script/Wacatac.B!ml (or similar).

This appears to be a machine-learning false positive from Microsoft Defender, but it prevents the installation of the CLI via Scoop.

Affected version

• gh version: 2.92.0
• Windows 11 version: Microsoft Windows 25H2 (OS Build 26200.8313)
• Windows Security Application Version: 1000.29554.0.1001
• Windows Security Service Version: 10.0.29554.1001-0
• Antimalware Client Version: 4.18.26030.3011
• Engine Version: 1.1.26030.3008
• Antivirus Version: 1.449.340.0
• Antispyware Version: 1.449.340.0

Steps to reproduce the behavior

1. Open a terminal on Windows 11 with Windows Defender active.
2. Run scoop install gh (or scoop update gh).
3. Windows Defender immediately throws a threat detection notification for Wacatac.

4. Scoop reports that the installation failed or the file is missing.

Expected vs actual behavior

Expected: scoop successfully downloads, extracts, and links the gh binary without triggering antivirus heuristics.
Actual: Windows Defender quarantines the download, breaking the Scoop installation process.

Additional context

I understand this is likely an issue with Microsoft's Defender heuristics (specifically the !ml machine learning flag for Go binaries) rather than an actual infection in the cli/cli release. I am providing my Security Intelligence version above in case this needs to be submitted to Microsoft for a false-positive clearance.