Anti-virus flagged Work-mode

Occasionally an anti-virus or endpoint tool flags Work-mode. This is afalse positive, and here's why it happens and what to do.

Why it happens

Work-mode's whole job is to change system settings — wallpaper, pinned apps, folder locations, notifications. That's exactly the kind of behaviour that heuristic ("looks-suspicious") scanners watch for, so a settings-changing tray app can trip a generic rule even though it's doing nothing harmful. Newly released or lightly-downloaded apps are also flagged more often until they build reputation.

How to confirm Work-mode is genuine

Every Work-mode build is code-signed and, on macOS, Apple-notarized, which means Apple has scanned it and confirmed the publisher. To check on macOS, the signature should show Captivated Ltd:

codesign -dv --verbose=4 /Applications/Work-mode.app
# Authority=Developer ID Application: CAPTIVATED LTD ...

Downloads come only from work-mode.online. If you got Work-mode anywhere else, remove it and download it from us.

Allowlisting it

Add Work-mode to your security tool's allowlist / exclusions. The exact steps vary by product, but generally:

• Open the security app's Protection history / Quarantine.
• Find the Work-mode detection and choose Allow orRestore & allow.
• Optionally add an exclusion for the Work-mode application so it isn't re-flagged after an update.

On a managed device, your IT team can allowlist Work-mode's signing certificate fleet-wide so no one sees the prompt.

Report a false positive

Reporting the detection to your AV vendor helps them clear it for everyone. Please also tell us at[email protected] with the product and detection name, and we'll follow up with the vendor.