We have updated the download URLS to end with /download. So if you now use "Save link as", it downloads as download.html. What should make it more obvious what happened.

Thanks.

Interesting!

OK, so I end up on this page when I go to download:
https://winscp.net/eng/download.php

My typical action at this point is to right-click on the green graphic that reads "DOWNLOAD WINSCP 6.1.2 (11 BM)", and then select "Save link as ..." so that I can store the downloaded file in the appropriate location in my Tools folder. This is what results in the 18 KB file download. If I then open that file with a text editor, I see that the first four lines of it are this (even though the file was saved with a .EXE extension):

BUT ... if I just (left-)click on that green oval graphic, then it takes me to a new page which then launches a 'Save As' dialog box. So, it does what I want to do, just in a fashion that differs from what I am accustomed to doing (based on other web sites).

Sorry for the false alarm.

Does the problem still persist? No one else reported the problem.
For me the downloads work correctly atm.
Did you try the "Alternative download" link?
The 18 KB matches the size of HTML download page.
Haven't you right-clicked on the "Download" button and selected "Save link as" (or equivalent in your browser), instead of clicking the link and waiting for the download to start?

I've tried downloading files today, and all I get is an 18K file. I've tried downloading v6.1.2 of the .exe as well as the portable (.ZIP) file, and the results are the same. I got the same result trying to download the latest Beta (.exe).

I've used three separate machines, using three different browsers (MS Edge, Chrome, Brave). One of the machines is at a completely different physical location (with a different public IP). All three machines are currently showing no malware.