Anti-virus programs sometimes flag mod files as malware because the mods may contain code or behaviours similar to actual threats. This can happen because mods might use techniques common in malware or have unusual file structures.