SEO Poisoning Campaign Uses Fake Chocolatey and MAS Sites to Deliver Armorsteal
Summary
Zscaler details a September 2026 SEO poisoning campaign using fake Chocolatey and Microsoft Activation Scripts sites to deliver Armorsteal, a Python malware family with remote-access, surveillance, and information-stealing modules.
Key points
- Fake sites at choclatey[.]org and massgravel[.]net targeted searches for Chocolatey and Microsoft Activation Scripts installation instructions; both delivered Armorsteal.
- Installers requested elevated privileges, placed Python 3.11 components under C:\Windows\SystemHealth\Update\, and created scheduled tasks for persistence.
- The remote-access module polls C2 every 60 seconds, verifies task signatures with an embedded RSA-2048 public key, and can update itself after checking a downloaded file’s SHA-256 hash.
- The surveillance module records keystrokes and window titles, monitors the clipboard, can replace cryptocurrency wallet addresses, and captures screenshots when configured keywords appear.
- The stealer targets browser data, passwords, Discord tokens, cryptocurrency wallets and seed phrases, SSH keys, Steam data, and password-manager files.
- Zscaler reported that the fake Massgrave site went down on September 25, 2026, and the fake Chocolatey site around October 1; the team said it continues to monitor the campaign.
Article Details
- Attack Vectors
- SEO-poisoned websites impersonating Chocolatey and Microsoft Activation Scripts displayed PowerShell commands that users could run to download and execute the Armorsteal installer.
- The installers requested elevated privileges, hid the PowerShell console, and downloaded ZIP archives containing a Python runtime and Armorsteal modules.
- Armorsteal persisted through the SysCheck2 user-logon and SysCheckX system-boot scheduled tasks.
- The remote access module downloaded and launched surveillance and information-stealing modules, and communicated with C2 servers over HTTPS.
- The malware collected keystrokes, clipboard contents, screenshots, browser data, Discord tokens, cryptocurrency wallet data, passwords, SSH keys, and Steam data.
- Defensive Notes
- Hunt for SysCheck2 and SysCheckX scheduled tasks and unexpected files under C:\Windows\SystemHealth\Update\.
- Review endpoint and network telemetry for PowerShell installers, Python processes, and connections to the listed C2 domains and IP addresses.
- Zscaler reports detections named PS.Dropper.Armorsteal, Python.PWS.Armorsteal, WIN-CONHOST-HEADLESS-CMD, WIN-SCHTASKS-CREATE-SHELL, and WIN-PYTHON-CHROMIUM-HEADLESS.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | choclatey[.]org | Typosquatted domain used for the fake Chocolatey website distributing Armorsteal. |
| DOMAIN | datamons[.]org | Armorsteal C2 domain initially used as standby and later observed active. |
| DOMAIN | massgravel[.]net | Fake Massgrave website used to distribute Armorsteal. |
| DOMAIN | niceer[.]net | Domain listed as an Armorsteal standby C2 server. |
| DOMAIN | pymons[.]is | Domain listed as an Armorsteal C2 server. |
| DOMAIN | supertrap[.]net | Domain listed as an Armorsteal standby C2 server. |
| DOMAIN | workerstats[.]net | Armorsteal C2 domain used to send system information and upload stolen data. |
| IPV4 | 186[.]2[.]163[.]185 | IP address identified as an Armorsteal C2 server. |
| IPV4 | 186[.]2[.]175[.]183 | IP address identified as an Armorsteal C2 server. |
| IPV4 | 190[.]115[.]31[.]69 | IP address identified as an Armorsteal C2 server. |
| IPV4 | 209[.]99[.]186[.]187 | Payload host identified in the Armorsteal network indicators. |
| IPV4 | 82[.]153[.]135[.]80 | Payload host identified in the Armorsteal network indicators. |
| SHA256 | 04d2828155ed2a276cfd3c97d4f966d328391dd818e04e773212cd601e49fa74 | SHA-256 of an older Armorsteal stealer module archive. |
| SHA256 | 0ea99fbbe29af6f797e3866ed5f822c7a5d3e9cdb990a8c382a715069f156499 | SHA-256 of the Armorsteal remote access module. |
| SHA256 | 237ba698d7dc8936c43e0e78e7644002375e51e8baf9b3a7d4e18683f871ee31 | SHA-256 of the Armorsteal surveillance module archive. |
| SHA256 | 3e3b62a9836697d978cbb620dc8af8f6eefdf8cb73fc30d16bb394d1c58f4c97 | SHA-256 of the Armorsteal remote access module archive. |
| SHA256 | 5410c2f239c3649928383c4478dea182f90b21f5b258081fec07e9d297ae4b1c | SHA-256 of the Armorsteal stealer module. |
| SHA256 | 56f05c4fb1c25c04e0dde60e2e5e41ac164a6dc53688d0f9eb52a55f82106389 | SHA-256 of an older Armorsteal stealer module archive. |
| SHA256 | 8fb7aaf2b9270b8b75f6844aaefd5242b4f926fb89cba10fff3d9b908a769788 | SHA-256 of the Armorsteal surveillance module. |
| SHA256 | be0329d0795dd62ae587faf97e704bb36413e5c98ddd8fe575f5077db3c84e5f | SHA-256 of the Armorsteal stealer module archive. |
| SHA256 | f3846ec2a6ff0a27d9ef2b9bf7908743b81d295ef29344acfb96ff83fff994f9 | SHA-256 of the install.ps1 installer for the fake MAS lure. |
| SHA256 | fb1181160e9f10ce1eb5e5dc9bc23e1498a39110ee9ea361fd150454cb01b292 | SHA-256 of the install.ps1 installer for the fake Chocolatey lure. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationArmorsteal's Python scripts were protected with Pyarmor, which encrypts Python bytecode and string constants.T1041 · Exfiltration Over C2 ChannelArmorsteal uploaded collected system information, keystroke logs, screenshots, and stolen data to its C2 endpoints.T1053.005 · Scheduled TaskArmorsteal created SysCheck2 and SysCheckX scheduled tasks for user-logon and system-boot persistence.T1056.001 · KeyloggingThe surveillance module logged keystrokes and recorded active-window titles.T1059.001 · PowerShellThe lure pages presented PowerShell installation commands that downloaded and executed the installer.T1059.006 · PythonArmorsteal used Python-based modules and executed signed Python task code in memory.T1071.001 · Web ProtocolsThe remote access module used HTTPS requests to communicate with C2 endpoints and retrieve tasks.T1105 · Ingress Tool TransferThe remote access module downloaded the surveillance and stealer modules, updates, and other files from C2.T1113 · Screen CaptureThe surveillance module captured screenshots when configured keywords appeared in window titles or captured keystrokes.T1115 · Clipboard DataThe surveillance module monitored clipboard contents and replaced copied cryptocurrency wallet addresses.T1497.001 · System ChecksThe remote access module checked public IP and organization information and exited when it detected certain cloud providers, hindering some cloud-based analysis.T1539 · Steal Web Session CookieThe stealer collected browser cookies, including through the Chrome DevTools Protocol.T1552.004 · Private KeysThe stealer collected SSH keys from infected systems.T1555.003 · Credentials from Web BrowsersThe stealer collected saved browser passwords and browser wallet data.T1555.005 · Password ManagersThe stealer targeted data from password managers including KeePass, 1Password, Bitwarden, and Dashlane.
Malware
Products
ChocolateyZscaler Threat Hunting identified an SEO poisoning campaign that used fake websites impersonating the Chocolatey package manager and the Microsoft Activation Scripts (MAS) tool to distribute a Python-based malwareMicrosoft Activation Scriptscampaign that used fake websites impersonating the Chocolatey package manager and the Microsoft Activation Scripts (MAS) tool to distribute a Python-based malware family we track as Armorsteal. The fakePyArmorremote access, surveillance, and information stealing capabilities, with the Python code protected by Pyarmor.Python 3.11PowerShell command that downloaded and executed the Armorsteal installer. The installer deployed a Python 3.11 runtime environment and three main components providing remote access, surveillance, and information