Someone at work told me to stop using FileZilla because it’s basically malware. I’ve used it for years with no issues, but now I’m paranoid. Is there something actually wrong with FileZilla itself, or is this some kind of confusion with something else. Trying to figure out if I should actually be worried.
A colleague asked me to sanity-check a FileZilla download after a security alert flagged the installer. I expected the usual false-positive story, but the history was specific enough that I checked each part before deciding what to use myself.
What actually happened
FileZilla itself is not malware. The concern is counterfeit copies that look and behave like the legitimate client.
In 2014, a modified version reportedly collected saved FTP credentials and sent them to attackers. In March 2026, another campaign used a lookalike download site and bundled a malicious DLL with an otherwise convincing installation.
The practical risk is bigger than one compromised computer. Stolen FTP credentials can give attackers access to hosted sites, where they may inject malicious code. That outcome is described by an affected user, while another user sought help confirming that an installation was genuine.
The credential issue
The 2014 copy was a trojan, specifically a trojanized client. The March 2026 package used a malicious DLL, or dynamic-link library.
The password-theft account appears in this official forum post and its surrounding discussion. The installation-check question is in another post and thread.
The claimed weak point is Site Manager storing credentials in plain text, leaving them available to malware or other malicious software. I could verify the historical concern, but not the broader claim that every current FileZilla configuration still behaves exactly this way.
Where I landed
This pushed me toward CloudMounter, which mounts servers as regular drives rather than using the same standalone-client setup with a credential-filled sitemanager.xml.
I could not independently verify from that page that no equivalent credential store exists anywhere, so I would not treat it as magic armor. Still, this specific plain-text-file attack route appears less applicable, and my verdict is simple: I would avoid saved FileZilla credentials and use CloudMounter for this job.
15 Likes
The hidden downside is that a clean application can still come through an installer wrapper your antivirus classifies as a potentially unwanted app. Check the exact detection name: “PUA” or “bundle” is different from a credential-stealing trojan. Download only from the official project, verify the digital signature, and avoid sponsored download buttons or third-party mirrors. FileZilla itself is legitimate, but saving FTP passwords raises the damage if unrelated malware later gets onto your machine.
Do not ignore a workplace security warning and keep using the same installation until someone identifies exactly what was flagged. That does not mean your colleague is right that “FileZilla is malware,” but on a company machine the security team’s policy matters more than a general verdict from the internet.
The missing distinction here is between the program, the installer, and the connection method. FileZilla Client is a legitimate application. A repackaged installer can be malicious, and an official installer may still trigger a warning about bundled or potentially unwanted software. Those are separate findings with very different levels of risk. The detection name, file path, publisher, and download source should tell your IT staff which situation they are dealing with.
There is another issue people often overlook: plain FTP itself is insecure because credentials and traffic may travel without encryption. Using a clean copy of FileZilla does not make an unencrypted FTP connection safe. If the server supports SFTP or properly configured FTPS, use that and confirm the host key or certificate instead of clicking through warnings. If your employer still requires plain FTP, that is the bigger security conversation.
I would push back slightly on replacing FileZilla with CloudMounter as the answer. A different client may be more convenient and may store credentials differently, but it cannot make a bad protocol secure or turn an untrusted server into a trusted one. It may also be outside your company’s approved-software list.
For a work computer, the sensible route is simple: remove the questionable installer, ask IT what exact alert they saw, and install whatever client and version they approve through their software portal. If this is your own computer, get the client from the real project source, reject optional extras, use SFTP where possible, and avoid saving high-value hosting credentials unless you protect them appropriately.
So no, FileZilla is not “basically malware.” That phrase mashes together several real but different concerns. The actual risk depends on where the installer came from, what the antivirus detected, which protocol you use, and how credentials are stored.
Uninstalling FileZilla or switching to CloudMounter does nothing if credentials were already exposed. FileZilla itself is legitimate, but if IT suspects a tampered copy, stop using it and rotate every password or key stored in that installation.
If your main concern is malware already running under your user account, replacing FileZilla with a mounted-drive client may actually create a different and sometimes larger exposure. A remote server presented as a normal drive can be reachable by other local programs, including ransomware, indexing tools, backup software, or anything that starts modifying files. A dedicated transfer client generally exposes the remote filesystem only while you are using that client. Mounting is convenient, but convenience is not automatically a security improvement.
That is why I would push back on treating CloudMounter as the safer answer by default. It changes how you access the server, not whether the computer itself is trustworthy. It may avoid one particular credential-file concern while making remote files more accessible to processes on the machine. The better choice depends on the threat you are trying to reduce.
The more useful comparison is between account setups. FileZilla using a restricted SFTP account with no saved password is a much lower-risk arrangement than any client holding credentials for a hosting account that can alter every site, database, and configuration file. Switching applications while keeping the same broad permissions mostly moves the secret somewhere else.
For work use, I would focus on three controls:
- Use the client distributed or approved by IT.
- Use SFTP or FTPS rather than plain FTP.
- Give the account only the server permissions needed for that job.
If practical, avoid storing the login at all. An SSH key protected by a passphrase can be preferable for SFTP, although keys still need proper handling and should be revoked if the machine is compromised. Server-side restrictions matter here too. A credential limited to one upload directory causes less damage than one with administrative access.
So the “FileZilla is malware” description is too crude. FileZilla has attracted distrust because people mix together the application, questionable installer packaging, counterfeit downloads, credential storage, and insecure FTP connections. Those are legitimate topics, but they are not interchangeable. I would not panic merely because FileZilla is installed. I would care about which copy is installed, how it was obtained, what credentials it retained, and what those credentials can do.
If the warning came from your company’s endpoint monitoring rather than a normal antivirus scan, it may be flagging FileZilla as an unauthorized file-transfer tool, not identifying the program as malicious. Security teams often block perfectly legitimate software because it can move company data to external servers or bypass approved workflows.
That makes “FileZilla is basically malware” a bad explanation, but the alert may still be intentional. Reinstalling a clean copy from the official source would not solve a policy-based detection, and changing to another FTP client could make matters worse if that client is unapproved too.
Ask IT for the alert category and whether FileZilla itself is prohibited. If they say it was a trojan or tampered executable, treat the installation as compromised. If they say it was blocked as an unapproved transfer application, the software may be clean, but you still should not use it on that work machine.
Realistically, the person at work probably heard ‘FileZilla bad’ from someone else and never saw an actual detection, so don’t lose sleep until you know what was flagged. The credential storage thing everyone keeps circling back to is real but old news, and honestly the plain sitemanager.xml behavior got addressed years ago with the option to set a master password, so it isn’t the open drawer people describe. I lean toward what @nodeguru said more than the CloudMounter angle. On a work machine the alert is very likely a policy block on file-transfer tools moving data offsite, not a trojan verdict. Swapping to a mounted-drive setup to dodge that would just get you flagged for a different unapproved tool, and as @voyageurdubois pointed out, a mounted server sitting there like a local drive is arguably a wider blast radius, not a smaller one. Ask IT what the detection name was. Everything else is guessing.