"Its been a week since we closed down the authentication servers for Honorbuddy. In this time, we tried to figure out what happened. We must say that we have no idea what really happened and all we have are speculations.
We speculate, that at some point, Blizzard used parts of the World of Warcraft client that acted in a hidden manner like malware. Then they scanned everything they could scan on a given computer and flagged the ones they thought were operating against their TOS/EULA. They are fine to install any such malware-type hidden software at any given time according to their End User Agreement."
That's directly from Bossland. Yes, they fully admitted to being detected and they have no clue why.
https://www.thebuddyforum.com/archives/216248-honorbuddy-announcement-21th-2015-a.html