As others have pointed out, FileZilla has been caught doing shady stuff for a while now. Antivirus doesn’t pick up on everything; furthermore, just because it’s clean today doesn’t mean it will be tomorrow, and FileZilla’s actions have demonstrated that they’re not above shipping malware. There are better, free tools out there that don’t have this issue. FileZilla fell behind the competition well over a decade ago; you should look into finding a new tool that meets your needs. WinSCP is a popular option.
Yes - this doesn't really answer my question. Another comment mentions the dark patterns trying to get you to install things you don't want in the process. That kind of thing is annoying but manageable. Quietly installing malware is a whole different animal, so I'm trying to get an explanation of if that's what's happening with the bad installation file above.
(And yes given this thread, I've already downloaded WinSCP to use going forward, though I haven't installed it / used it yet.)
