Many antivirus software mark Bitcoin wallets as being malware because they look for wallet files. When an antivirus sees a particular software looking for a wallet file, it may flag that software as a virus. This is because coin stealing malware and your Bitcoin wallet software both do very similar things. Both will look for a wallet file, open the file, read the private keys, and send Bitcoin. The only difference is that a coin stealing malware will either send the Bitcoin automatically to the attacker's address but your wallet software will let you choose who to send your Bitcoin to and only when you want it to do that.

Coin stealing malware may also look for your wallet file and send that to the attacker.

So because coin stealing malware and wallet software behave similarly (especially with the looking for wallet files part), many antivirus software will mistakenly flag a wallet software as being a virus.