MrAntiFun trainers use code injection to read the game’s memory. This looks exactly like what a virus does to your system. 99% of the time, it is a false positive. However, always download directly from the official MrAntiFun forums or his community page (like WeMod) to ensure you aren't grabbing a fake version loaded with malware.