Fake Chocolatey and Microsoft activation sites distribute ArmorSteal
Zscaler says the September campaign's Python malware also logs keystrokes, swaps wallet addresses, and checks C2 every 60 seconds.
66
Malware
Armorsteal
- Mentions · 7d1
- Mentions · 30d2
- All mentions2
- First seenOct 22, 2026
- Last mentioned6d ago
Timeline
2 articles · newest firstSEO poisoning campaign delivers new Armorsteal malware
Fake Chocolatey and Massgrave sites installed a Python remote-access module that steals system data and runs signed tasks.
62
Appears with
- Zscaler ThreatLabzorganization · 1
- Microsoft Activation Scriptsproduct · 1
- Chocolateyproduct · 1
- Zscalerorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.