Datto AV - Increase in PDF detection as PHISH/PDF

Final update

This incident has been resolved.

1. Resolved · Nov 3, 17:47 UTC
   This incident has been resolved.
2. Monitoring · Oct 29, 15:13 UTC
   Our engineering team has identified the issue and is monitoring the fix. Some PDF files, were incorrectly flagged as PHISH/PDF.Agent. A specific detection rule has been disabled in VDF 8.21.8.130, deployed October 28, 2026. The rest of the PHISH detection category remains active. We are monitoring to confirm new false positives have stopped. Files that have already been quarantined must be restored manually.
3. Investigating · Oct 28, 18:50 UTC
   We are aware of a problem where Datto AV is incorrectly flagging newly created .pdf files as PHISH/PDF, causing the files to be quarantined. The Kaseya R&D Team is currently investigating this issue. In the meantime our Support team has been supplied with a workaround and can assist you with implementing it. If you would like to have the workaround applied, please create a ticket with our Support team or contact them at 833-863-2237. To work around this issue: Adding exclusions for the affected folders and files. Then restoring the affected files. Subscribe to the Kaseya Status Page for up-to-date information at https://status.kaseya.com/