Trojan:Script/Phonzy.A!ml and B!ml: False Positive or Malware?

Trojan:Script/Phonzy.A!ml and Trojan:Script/Phonzy.B!ml are Microsoft Defender family detections, not proof that every flagged file has one fixed behavior. Keep the item quarantined while you record the exact label and affected path, then check whether the file was only stored in an archive or browser download cache or actually ran. Treat an alert from an email script, unknown cloud link, crack, mod, or unsigned installer as unsafe until verified. If the file is your own freshly compiled build or comes from a trusted signed tool, update Defender, verify its source or hash, and submit the exact item to Microsoft before restoring it.

What is Trojan:Script/Phonzy.A!ml or B!ml?

Microsoft Security Intelligence lists Trojan:Script/Phonzy.A!ml as a Defender script Trojan detection and says Defender detects and removes it [1]. Huntress describes Phonzy as a detection-family label whose behavior can vary by sample rather than one fixed malware codebase [4]. The label alone therefore cannot prove a specific capability. The affected item path, source, signature, and whether it executed are the practical evidence.

The Microsoft Defender detection name format still matters: Script or Win32 is the platform field, Phonzy is the family label, A or B is a variant, and !ml indicates machine-learning classification. A Win32 result does not automatically mean a different infection from a Script result, and an ML suffix does not make the alert harmless. Use the exact full label when searching or submitting the affected file.

Phonzy.A!ml in a ZIP, 7z, RAR, or MEGA download

Archive detections create false-positive anxiety because Defender may report the archive member rather than a file you intentionally ran. Do not judge the alert from the extension alone. A compressed file can contain scripts, shortcut files, HTML payloads, installers, or obfuscated JavaScript even when the outer archive looks ordinary.

• If the archive came from a crack, mod, game repack, password-protected link, or unknown MEGA folder, delete it and keep Defender’s quarantine.
• If the file came from your own project or a trusted vendor, compare hashes, redownload from the official source, update Defender security intelligence [3], and submit the exact file to Microsoft as an incorrect detection if evidence supports a false positive [2].
• If you only opened the archive but did not run anything, remove the archive/source and run a full scan. For general archive risk, see our guide on whether opening a ZIP or RAR file can give you a virus.
• If you executed a script, installer, or command from the archive, treat the event as a possible compromise and continue with the cleanup steps below.

Could a developer build or trusted utility be a false positive?

A freshly compiled plugin, unsigned automation script, self-extracting bundle, or uncommon utility can trigger an ML detection, but ownership of the source is evidence, not an automatic clean verdict. Rebuild from reviewed source on a clean machine, compare the output hash, verify the expected signer when one should exist, update Defender definitions, and submit the exact file to Microsoft. Do not create a broad exclusion for a workspace, Downloads, Temp, or an entire app folder while the result is unresolved.

If Windows Security asks to send or review a sample, the Defender sample-review guide explains the separate privacy and submission decision. A downloaded release that differs from your clean reproducible build should remain quarantined.

Can Phonzy.A!ml or B!ml be a false positive?

False positives are possible, especially with custom scripts, freshly compiled files, packed software, browser cache artifacts, or security tooling. The safer test is source plus execution state: a reproducible file from reviewed source that stays clean after updated scans is different from a script delivered through an ad, fake update, crack, or unknown cloud link. Avoid exclusions until Microsoft or another trusted analysis supports a clean verdict.

If the alert appeared after you ran an unknown game/mod installer or entered passwords afterward, also review account risk. Our infostealer detection and recovery guide covers password changes, session revocation, and browser-token exposure.

Why does the Phonzy alert keep coming back?

A repeated alert means Defender is seeing the same item again or a parent app, download, archive, browser component, task, or startup entry is recreating it. Match each new event to its affected path instead of clearing Protection History.

• Browser cache or Downloads: close the browser, remove the original download, review recent extensions, clear the relevant cache, and rescan.
• Archive or extracted folder: delete both the extracted item and the parent ZIP/7z/RAR or cloud download; otherwise extraction can trigger the same label again.
• App or developer output: update or repair the trusted app, compare the rebuilt file, and submit the exact repeated sample rather than excluding its folder.
• Startup, Task Scheduler, AppData, or Temp: treat recurrence as possible persistence, quarantine the visible item, inspect what launches it, and run an updated full or Offline scan.

How to remove Trojan:Script/Phonzy.A!ml or B!ml

1. Open Windows Security and choose Remove or Quarantine for the Phonzy detection.
2. Write down the affected item path, then delete the original download, archive, email attachment, or extracted folder that produced the alert.
3. Update Microsoft Defender security intelligence before rescanning [3].
4. Run a full scan. If the alert returns, or if the script ran before Defender blocked it, run Microsoft Defender Offline from Windows Security.
5. Check Startup Apps, Task Scheduler, browser extensions, Run keys, and recently installed apps if the file executed.
6. Change important passwords from a clean device if the script ran, opened a phishing page, or was bundled with a crack/mod/download manager.
7. Run a second-opinion Gridinsoft Anti-Malware scan if Defender reports remediation incomplete, repeated detections, or suspicious startup/browser behavior.

If Phonzy came from an archive, MEGA download, crack, mod, or fake update, deleting one script may not remove the downloader or source package. Scan for the item that keeps extracting, restoring, or launching the script alert.

FAQ

References

1. Microsoft Security Intelligence. “Trojan:Script/Phonzy.A!ml threat description.” Microsoft, published January 21, 2021, accessed August 21, 2026. Microsoft Phonzy.A!ml threat description.
2. Microsoft Security Intelligence. “Submit a file for malware analysis.” Microsoft, accessed August 21, 2026. Microsoft file submission portal.
3. Microsoft Security Intelligence. “Security intelligence updates for Microsoft Defender Antivirus and other Microsoft antimalware.” Microsoft, accessed August 21, 2026. Microsoft Defender security intelligence updates.
4. Lizzie Danielson. “Phonzy Malware.” Huntress Threat Library, published December 23, 2025, updated August 14, 2026, accessed August 21, 2026. Huntress Phonzy family overview.