Threat reportMalwareTL-2026-3925
JPHP-based Windows loader (suspected d3f@ck loader) with Telegram dead-drop C2 and Defender exclusion
JPHP-based Windows loader (suspected d3f@ck loader) with (TL-2026-3925), also tracked as D3F@ck loader (suspected), is a medium-severity malware campaign, first published 2026-10-20. It has no confirmed attribution, affects Microsoft Windows (Microsoft Defender Antivirus exclusion abuse), maps to 11 MITRE ATT&CK techniques (T1027, T1053.005, T1059.001), and is covered by 9 detection rules and 31 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 11MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 31Indicators of compromise
Key facts for TL-2026-3925
- Threat ID
- TL-2026-3925
- Also known as
- D3F@ck loader (suspected), JPHP loader, Pronsis Loader (related)
- Severity
- MEDIUM
- Status
- MONITORING
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Detection rules
- 9
- Indicators of compromise
- 31
Malware and tooling in JPHP-based Windows loader (suspected d3f@ck loader) with
Malware and tooling: DanaBot, Latrodectus - S1160, Lumma Stealer - S1213, Pronsis Loader, Raccoon Stealer - S1148, STRRAT
How JPHP-based Windows loader (suspected d3f@ck loader) with works
A Windows loader compiled with JPHP (PHP on the JVM) bundles its own JRE, adds a Windows Defender exclusion through an elevated hidden PowerShell, and resolves its download infrastructure from Telegram dead-drop pages. It then downloads an executable that is launched through javaw.exe -jar. The family attribution to D3F@ck loader is only suspected in the primary source; related JPHP loaders (Pronsis, an AhnLab-reported downloader) share the technique set.
Tony Lambert (Forensic IT Guy, 2024-07-20) analyzed a 32-bit MinGW-built Windows executable (SHA256 94edf5396599aaa9fca9c1a6ca5d706c130ff1105f7bd1acff83aff8ad513164, sourced from MalwareBazaar) that carries a ZIP overlay of roughly 19 MB. The overlay is a JPHP application package with JPHP-INF/.bootstrap as the entry point (app\modules\AppModule, include of res://.inc/jurl.phb), forms under app/forms (MainForm.phb holds the main loader logic) and modules under app/modules. JPHP compiles PHP to Java bytecode stored in .phb files. Standard Java decompilers do not read these files directly, but they contain embedded class files (Java class version 50.0) that binwalk --dd=.* can carve and CFR can decompile.
Behavior recovered from the decompiled code: (1) Defense evasion - the loader runs Powershell.exe -Command "& {Start-Process Powershell.exe -WindowStyle hidden -ArgumentList '-Command \"Add-MpPreference -Force -ExclusionPath \"C:\\\""' -Verb RunAs}", which excludes the whole C:\ drive from Microsoft Defender scanning. (2) C2 resolution - URLs and URL fragments are Base64-encoded. A Telegram channel page is fetched and a Base64 URL is read from its og:description meta tag, which is a dead-drop resolver. A Pastebin URL is also used for domain resolution and had already been taken down at analysis time. The loader checks in periodically. (3) Payload delivery - an executable named 93.exe is downloaded from partial URLs whose domains are filled in from the dead-drop content, then auto-executed. (4) Execution - the payload is run as "<dir>\v2024\bin\javaw.exe" -jar "<dir>\Win Installer x64.exe". The v2024 folder is a bundled JRE (java.exe, javaw.exe, javacpl.exe, java.dll, awt.dll, JAWTAccessBridge.dll). Because Java reads a JAR (ZIP) from the end of the file, a single file can be both a valid PE and a valid JAR, so the executable is passed to javaw as a JAR argument.
Context from related reports: the D3F@ck loader is a malware-as-a-service loader first seen in January 2024. It was spread through Google Ads and fake application sites, used Inno Setup installers and EV certificates, and delivered Raccoon Stealer and DanaBot. LevelBlue SpiderLabs / Trustwave (2024-10-08) describes the Pronsis Loader, a separate JPHP loader that uses NSIS installers instead of Inno Setup, avoids certificates, runs Add-MpPreference -ExclusionPath $env:USERPROFILE through a randomized batch file in %Temp%, creates scheduled tasks and a mutex, and delivers Latrodectus and Lumma Stealer. AhnLab ASEC (2025-03-14) reports a JPHP downloader that bundles a JRE, disables Defender behavior monitoring, uses t.me short links, and reads a secondary C2 IP from between 'i1il' strings in Telegram channel page content. It is associated with STRRAT and DanaBot. The analyzed sample is therefore one member of a wider JPHP loader cluster, and the primary source does not state attribution, victimology or in-the-wild campaign details.
MITRE ATT&CK techniques used in TL-2026-3925
Defense Evasion
T1027 Obfuscated Files or Information; T1140 Deobfuscate/Decode Files or Information
Persistence
T1053.005 Scheduled Task/Job: Scheduled Task
Execution
T1059.001 Command and Scripting Interpreter: PowerShell; T1059.003 Command and Scripting Interpreter: Windows Command Shell; T1204.002 User Execution: Malicious File
Command and Control
T1071.001 Application Layer Protocol: Web Protocols; T1102.001 Web Service: Dead Drop Resolver
Discovery
T1082 System Information Discovery; T1518.001 Software Discovery: Security Software Discovery
defense-impairment
Affected products and versions in JPHP-based Windows loader (suspected d3f@ck loader) with
- Microsoft — Windows (Microsoft Defender Antivirus exclusion abuse)
Vulnerable versions: Windows endpoints where an elevation prompt can be accepted and Defender Tamper Protection is disabled
Remediation for JPHP-based Windows loader (suspected d3f@ck loader) with
Immediate actions
- Hunt for powershell.exe command lines containing Add-MpPreference with -ExclusionPath C:\ (or %USERPROFILE%) and for hidden Start-Process ... -Verb RunAs PowerShell launches
- Hunt for javaw.exe launched with -jar pointing at a .exe file or from a user-writable directory such as a bundled v2024\bin\ JRE
- Review Microsoft Defender exclusion lists (Get-MpPreference) for unexpected drive-wide or profile-wide exclusions and remove them
- Block or alert on the listed IPs and domains; alert on workstation egress to t.me, telegram.me and pastebin.com from non-browser processes
- Isolate hosts where the sample hash or related hashes are found and triage for downstream payloads (Lumma Stealer, Latrodectus, DanaBot, STRRAT)
Workarounds
- Block outbound javaw.exe network access on hosts with no approved Java use
- Deny execution of bundled JRE directories outside approved software paths
Longer-term hardening
- Enable Defender Tamper Protection and manage exclusions only through central policy
- Alert on Defender configuration changes (event IDs 5007 and 5013) and on Defender service tampering
- Restrict standard users from elevating hidden PowerShell and from running unsigned installers from user-writable paths
- Application control (WDAC/AppLocker) to block executables run from %TEMP%, Downloads and AppData, and unexpected JRE copies
- User awareness against fake application download pages and sponsored search results
Timeline of JPHP-based Windows loader (suspected d3f@ck loader) with
- Latrodectus malware, later delivered by the related Pronsis JPHP loader, discovered (October 2023; month-level date per Trustwave)
- Earliest related Pronsis JPHP loader variant observed (November 2023; month-level date per Trustwave)
- D3F@ck loader, a JPHP-using MaaS loader, first seen in the wild (January 2024; month-level date)
- Trustwave observes related Pronsis/JPHP loader campaign activity (March 2024; month-level date)
- Additional Pronsis loader variants detected (June 2024; month-level date per Trustwave)
- Forensic IT Guy publishes the analysis of the JPHP loader (SHA256 94edf539...3164) with binwalk and CFR decompilation
- LevelBlue SpiderLabs/Trustwave publishes the Pronsis Loader analysis, separating it from D3F@ck (NSIS vs Inno Setup, no certificates) and documenting Lumma Stealer and Latrodectus delivery
- AhnLab ASEC reports a JPHP downloader using Telegram channel pages as dead-drop C2 and delivering STRRAT and DanaBot
Sources cited for JPHP-based Windows loader (suspected d3f@ck loader) with
- Decompiling a JPHP Loader with binwalk and cfr (Forensic IT Guy)
- Pronsis Loader: A JPHP-Driven Malware Diverging from D3F@ck Loader (LevelBlue SpiderLabs / Trustwave)
- Downloader Malware Written in JPHP Interpreter (AhnLab ASEC)
- D3Fack Loader: New Malware Exploits Google Ads and EV Certificates (Hive Pro TA2024201)
- D3F@ck Loader, the New MaaS Loader
- New D3F@ck Loader Exploits Google Ads, Abuses Trusted Certificates to Bypass Security
- Malpedia: jar.pronsis_loader
- MalwareBazaar sample 94edf5396599aaa9fca9c1a6ca5d706c130ff1105f7bd1acff83aff8ad513164
Detection coverage for TL-2026-3925
As of 2026-10-20, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3925 across Splunk SPL, Microsoft KQL and Sigma, covering 31 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.