Is RVTools safe? Three different questions, three answers
People search this for one of three reasons: they are worried the tool will change something in production, their antivirus flagged the installer, or someone in security asked what the export contains. Those have different answers, and only one of them is a genuine concern.
1. Will it change anything in vCenter? No.
RVTools connects to the vSphere web services API and issues read queries. It has no write path: it cannot power a VM on or off, modify a configuration, migrate a workload, or delete a snapshot. This is why it is one of the few third-party tools infrastructure teams will routinely allow against production vCenter.
You do not have to take that on trust, either. Run it under a dedicated account holding only the built-in Read-only role, as described in how to run RVTools. Then the read-only property is enforced by vCenter rather than assumed of the tool, and the question stops being interesting.
2. Why did my antivirus flag the installer? This one is real.
In May 2025 a trojanized RVTools installer carrying the Bumblebee malware loader circulated and was widely reported. This is the origin of essentially every "rvtools malware" search, and it deserves a straight account.
What is well established: a malicious installer was first submitted to VirusTotal on 12 May 2025. It was materially larger than the legitimate installer, and its hash did not match the value published on the official download page. Around 33 of 71 antivirus engines identified it as a Bumblebee variant. It was discovered when an employee ran the installer and Microsoft Defender flagged a suspicious version.dll attempting to execute from the installer's directory, a classic DLL side-loading pattern. The researcher Aidan Leon publicised the finding in mid-May, and the official sites went offline shortly afterwards.
What is disputed: whether the malicious file was ever served from the official site. The researcher's account was that it was obtained from the official download. Dell's position, issued around 20 May 2025, was that robware.net and rvtools.com had not been compromised, that they were taken offline in response to denial-of-service attacks, and that lookalike domains such as rvtools[.]org were distributing malware while ranking well in search results. We have no first-hand visibility into which account is correct, and we are not going to pretend otherwise. The practical guidance is identical either way.
Reporting: Help Net Security ↗, The Hacker News ↗, and Arctic Wolf ↗. Vendor sources: robware.net ↗ and Dell ↗.
What to actually do about it
- Download only from an authorized source. Dell Technologies, robware.net, and rvtools.com. Search results are not an authorization mechanism, and in this incident a lookalike domain reportedly ranked well.
- Verify the hash before you run it. Compare the downloaded file's hash against the value published on the official page. This is the control that would have caught the malicious installer, and it takes about fifteen seconds.
- Check the file size. A crude check, but the trojanized build was noticeably larger than the legitimate one. If the download is meaningfully bigger than you expect, stop.
- If you installed RVTools between roughly early and mid-May 2025, treat it as worth investigating: look for an unexpected
version.dllin the installation directory and review endpoint telemetry from that window. Follow your own incident process rather than ours. - Do not suppress the antivirus alert to get the install done. This is the specific behaviour the attack relies on, and it is the one place where ordinary impatience turns a blocked attack into a successful one.
3. What does the export contain? More than people expect.
The security question that gets asked least and matters most. A complete RVTools workbook is a full map of your virtual infrastructure: every VM name and hostname, IP addresses, guest operating systems and their patch-relevant versions, cluster and host topology, datastore names and capacities, network port groups, and licensing detail. Written down in one file, that is high-quality reconnaissance material for anyone planning an attack on your estate.
Three habits worth adopting:
- Classify it. The export should carry the same handling classification as an infrastructure diagram, because functionally it is one.
- Watch where it gets uploaded. Estate exports routinely get emailed to vendors and dropped into assessment portals during migration scoping. Each of those is a copy of your infrastructure map outside your control, and they are rarely tracked or deleted afterwards.
- Prefer local processing. Our RVTools analyzer parses the workbook entirely in your browser using client-side JavaScript. There is no upload, no server, and no analytics event carrying its contents. You can load the page, disconnect from the network, and it still works, which is the only version of that claim you can actually verify yourself.
Frequently asked
Is RVTools a virus?
No. RVTools is a legitimate VMware inventory utility, originally written by Rob de Veij and owned by Dell Technologies since 2023. The reason people search this is a real May 2025 incident in which a trojanized RVTools installer carrying the Bumblebee malware loader circulated and was flagged by antivirus engines. The tool itself is not malicious; a tampered copy of its installer was.
Can RVTools change or damage my VMware environment?
No. It authenticates to the vSphere web services API and issues read queries only. There is no code path that powers VMs on or off, edits configuration, or deletes data. A read-only vCenter role is sufficient to run it, which is a good way to enforce that property rather than rely on it.
How do I check the RVTools installer I downloaded is genuine?
Compare the file hash against the hash published by the vendor on the official download page before running it, and download only from Dell, robware.net, or rvtools.com. In the May 2025 incident the malicious installer was noticeably larger than the legitimate one and its hash did not match the published value, so a hash check would have caught it.
What was the Bumblebee malware in the RVTools installer?
Bumblebee is a malware loader used to establish initial access and then pull down further payloads, historically including ransomware and post-exploitation frameworks. In this case it was delivered through a malicious version.dll placed alongside the installer, which is why endpoint protection flagged that filename specifically.
Is it safe to email or share an RVTools export?
Treat it as confidential. A full export is a complete map of your virtual infrastructure: hostnames, IP addresses, guest operating systems and their versions, datastore layout, cluster topology, and licensing detail. It is genuinely useful reconnaissance material. Share it over controlled channels, and prefer tools that process it locally over ones that upload it.
Should I still use RVTools?
Yes, with the same care you would apply to any tool that takes privileged credentials: download from an authorized source, verify the hash, run it under a dedicated read-only account, and handle the output as sensitive. The incident was a distribution-channel compromise, which is a supply-chain risk that applies to essentially all downloadable software, not a flaw in what RVTools does.