delphiaonline.top: a Windows malware download site with PowerShell and JavaScript stubs, and what to do if one ran

What delphiaonline.top is, and what we know about it

delphiaonline.top is a web address, not a program on your PC. It is a domain that the abuse.ch project URLhaus lists as a place where malware was served. No public write-up of this domain exists that we could find, and no report names a malware family for it, so this page rests on what URLhaus shows, what we saw ourselves and what Microsoft documents about the tools involved.

1. 1

   What URLhaus lists

   Three file addresses on delphiaonline.top, all added on 29 September 2026 by the abuse.ch reporter account. At 07:09 UTC came https://delphiaonline[.]top/defounder/secured_stub.ps1. At 07:10 UTC came https://delphiaonline[.]top/mrdef/secured_stub.ps1 and https://delphiaonline[.]top/def/73yTfqg3w2y6fw4jE4h5dW.js. All three carry the threat type malware_download and were offline when we read them.

2. 2

   What the tags mean

   ps1 and powershell say that two files are PowerShell scripts. js says that the third is a JavaScript file. ascii says all three are plain text, not compiled programs. opendir says the files sat in a server folder that anyone could list. No tag names a malware family, which is why this page does not claim one.

3. 3

   What we could not confirm

   We did not download any of the files and we never saw a page that tells visitors what to do. So we do not know how a victim reached a script, what the stubs load, or whether the JavaScript file starts them. The tags are the reporter's labels, not our finding.

4. 4

   What this means for you

   If you only saw the name in a log, a link or a warning, you are not infected by that alone. The risk is for people who opened a script file that reached out to this address, pasted a command that did, or ran a file that came from it.

Kind of threat

A malware download address: two PowerShell scripts and one JavaScript file, all plain text

Malware family

Not named by any source we found. The tags do not give one

Domain registered

28 September 2026, expires 28 September 2027, registrar Spaceship, Inc.; record last changed 28 September 2026 (RDAP, read 10 October 2026)

URLhaus entries

3 file addresses, all added on 29 September 2026; all 3 offline when we read them

Platform

Windows, by the ps1 tag. No source says which other systems are hit

What we checked on 10 October 2026, and what we could not

We tried to open https://delphiaonline.top/ once, from Lithuania, in an automated Chromium browser set to English. The browser reported that the name could not be found, so no page loaded. That tells you nothing good about the site and it clears nothing.

What happened to delphiaonline.top, from registration to our test

The history is very short. The domain was registered on 28 September 2026 and the three malware addresses were reported the next morning, so the name looks bought for this purpose. The dates come from RDAP and from the URLhaus database.

1. 28 September 2026

   The domain is registered

   RDAP shows delphiaonline.top registered on 28 September 2026 through the registrar Spaceship, Inc., valid until 28 September 2027. The name sounds like an online service; nothing we found shows a real business behind it.

2. 29 September 2026

   Two PowerShell stubs and a JavaScript file are reported

   At 07:09 UTC URLhaus receives secured_stub.ps1 from the folder /defounder/. One minute later it receives secured_stub.ps1 from /mrdef/ and a JavaScript file with a random 22 character name from /def/. All three carry the tag opendir. This is the first and only time URLhaus sees the host.

   

3. 10 October 2026

   Our test finds no address

   Our browser visit to https://delphiaonline.top/ ends in ERR_NAME_NOT_RESOLVED, and URLhaus shows all three files offline. Eleven days after the reports, nothing answers.

We could not read the URLhaus pages themselves, because they ask for a browser check. The entries above come from the same data in our own database, which holds the URLhaus feed.

The three files: what each name suggests, and what we do not know

File names are weak evidence. We list what each one could be and mark which statements are only a reading of the name and tags.

The folder names def, mrdef and defounder look like labels the operator chose for different batches. They might be short for defender, but we found no source that says so, and we do not claim the scripts touch Microsoft Defender. Treat the names as a reason to check your Defender settings, which the plan below does, and nothing more.

What the opendir tag tells you about the server

opendir means the folder listing of the server was open, so a researcher or any visitor could see the file names. It is a sign of a quickly set up server, and it is how the reporter found three files in three folders.

Because the folder was open when the reporter looked, the files were probably found by browsing the server, not by clicking a link in a message. That does not tell us how real victims were sent there, which stays unknown.

Why a PowerShell stub can run even with Windows protections on

Many people believe that Windows will refuse to run a downloaded script. Microsoft's own documentation says the PowerShell execution policy is a safety feature, not a security boundary, and gives the reason.

1. 1

   What the execution policy is

   Microsoft says the execution policy controls the conditions under which PowerShell loads configuration files and runs scripts. On Windows clients with no policy set, the effective policy is Restricted, which blocks script files but allows single commands.

2. 2

   Why it does not stop a pasted command

   Microsoft's page states that the execution policy is not a security boundary: users can easily bypass it by typing the script contents at the command line. A command you paste into PowerShell is therefore not blocked by it.

3. 3

   Why downloads by command are different

   Browsers mark downloaded files as coming from the internet, and the RemoteSigned policy then refuses unsigned ones. Microsoft notes that other download methods such as curl.exe, Invoke-RestMethod and Invoke-WebRequest may not add that mark. A script fetched by a command can lack the mark.

4. 4

   What this means here

   A short command that downloads secured_stub.ps1 and runs it, or a JavaScript file that starts PowerShell, does not need you to change any setting. We do not know which route victims met, but the point is that the built-in rule is not the thing that protects you.

What a script stub could mean for you

We did not open the files and found no analysis of them, so we cannot list what this copy does. The table below is the general meaning of each kind of part, not a claim about this site's files.

What this can cost you

Reading the site name or seeing a warning costs nothing. The risks below apply to a PC where a script from the site ran or a file from it was opened.

• High

  Logins your browser remembers

  A script that runs under your Windows account can reach whatever your browser stores. Reset passwords on another device and end all sessions, since the old session may outlive the old password.

• High

  Lost cryptocurrency

  Treat wallet files and recovery phrases on the PC as seen by someone else. A transfer cannot be undone, so shift the balance to a fresh wallet created on a clean device first.

• High

  A second program you cannot see

  A stub is made to bring something else. Until you have scanned from outside Windows, assume the PC may be running a program that the first script installed.

• Medium

  Weakened protection

  If a script added exclusions to Windows Security, a later file in those folders would not be scanned. Check the exclusions list in the plan below.

• Medium

  Work accounts and company data

  On a work PC the saved logins reach company systems. Tell your IT or security team at once; they can block the accounts.

• Low

  Nothing, if you only saw the name

  A name in a warning, a firewall log or a blocked link is not an infection.

What you may notice, and what you may not

Many victims notice nothing. The signs below follow from how script chains are built; the first one is the best evidence you have.

How people end up running a script like this

We do not know how visitors reached delphiaonline.top, and no source says. These are the usual ways a .js or .ps1 file ends up running, listed so you can ask yourself which one fits.

1. 1

   A script attachment or archive

   An email or a message carries a .js file, or a zip with one inside, named like an order, an invoice or a document. On Windows, double clicking a .js file runs it with Windows Script Host; it is not shown as a document.

2. 2

   A command you are told to paste

   Some pages ask you to copy a command into the Windows Run box or PowerShell to pass a check or fix an error. The ps1 tag fits that way of starting a script, but no source tells us this site did so. We did not see its page.

3. 3

   A file that claims to be an update or a free program

   Cracked software and fake updates are common carriers for downloader scripts. This is general knowledge, not something we saw on this domain.

4. 4

   A link from a search result or an advert

   A new domain bought a day before use may be promoted by advertising or by links in messages. We have no evidence of which was used here.

Check your Windows PC before you delete anything

Start with the question that matters: did you open a script file or paste a command that fetched something from delphiaonline.top, or run a file that came from it? If yes, follow the numbered plan on this page, because a clean-looking check does not clear a PC. If you are not sure, do these checks first. None of them deletes anything.

While you check, stop using the PC for banking, email, work or crypto, and disconnect it from Wi-Fi and network cables if you can.

1. 1

   Search for the file names

   Open File Explorer, click the search box and type secured_stub. Look in Downloads, C:\Users\Public and the Temp folder (type %TEMP% in the address bar). Do not double click anything you find. Note the folder and date.

2. 2

   Open Task Scheduler

   Type Task Scheduler in the Start menu and open it. Click Task Scheduler Library and go through the list. For a task with a random or odd name, open its Actions tab and read the command. Leave it in place for now and write the name down.

3. 3

   Open the Startup folder

   Hit Windows key + R, enter shell:startup and confirm. Anything in there that you did not put in yourself deserves a note.

4. 4

   Read the Run history after a pasted command

   Start Registry Editor with regedit and browse to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU. Each value is something typed into the Run box. Only read them. Mark any that mention powershell, a web address or delphiaonline.

5. 5

   Check the Windows Security exclusions

   Open Windows Security > Virus & threat protection > Manage settings > Add or remove exclusions. Every entry is a place that Windows Security does not scan. Any folder you did not add yourself is a warning sign. Microsoft's page says you usually do not need exclusions at all. An administrator can list them in PowerShell, as Microsoft documents, with Get-MpPreference and its ExclusionPath value. Note anything unknown and do not remove it until after the offline scan.

6. 6

   Check Windows Security detections

   Open Windows Security > Virus & threat protection > Protection history. On Windows 10 the same page is under Settings > Update & Security > Windows Security. Look for detections dated around the time the script ran.

7. 7

   Remember what a clean check means

   A downloader script may leave little on the disk once it has done its work. A clean check lowers the doubt; it does not remove it.

Scan from outside Windows: Microsoft Defender Offline

An offline scan runs before the normal Windows starts, so a hidden program cannot hide from it as easily. Microsoft's page says it targets malware that tries to bypass the Windows shell, such as rootkits.

1. 1

   Get the PC ready

   Save open files and quit your programs, because the PC will restart by itself. The offline scan needs an administrator account and a working Windows Recovery Environment. Open Command Prompt with Run as administrator and type reagentc /info. If the status reads Disabled, type reagentc /enable. Microsoft warns that with recovery switched off the scan never starts and no error appears.

2. 2

   Pause BitLocker first

   A PC with BitLocker on the system drive may demand the recovery key at the restart. Suspend BitLocker before you begin, using Microsoft's linked instructions, so the scan can start without a prompt.

3. 3

   Launch it from Windows Security

   Go to Windows Security > Virus & threat protection > Scan options, tick Microsoft Defender Offline scan and press Scan now. Accept the two prompts. Windows signs you out and boots into a blue scanning screen. Microsoft says it takes about 15 minutes. As an administrator you can also type Start-MpWDOScan in PowerShell.

4. 4

   Find what it caught

   When Windows returns, open Windows Security > Virus & threat protection > Protection history. Windows 10 reaches the same screen through Settings > Update & Security > Windows Security. Microsoft lists Windows on ARM as unsupported, and says Defender Antivirus must be your main antivirus.

5. 5

   Tidy the exclusions

   Return to Add or remove exclusions and delete every entry you did not create. If you removed one, run the offline scan a second time, since the files in that folder were skipped on the first pass.

6. 6

   Treat a clean report with care

   No detection is not proof of a clean PC when a script may have brought a second program. If one of these scripts really ran on your machine, copy your documents off and reinstall Windows.

If you use a Mac, an iPhone or an Android phone

The ps1 tag points at Windows. We found nothing that says the three files run on anything else.