Fake Chocolatey and Microsoft activation sites distribute ArmorSteal
Zscaler says the September campaign's Python malware also logs keystrokes, swaps wallet addresses, and checks C2 every 60 seconds.
66
Product
Microsoft Activation Scripts
- Mentions · 7d1
- Mentions · 30d1
- All mentions1
- First seenOct 24, 2026
- Last mentioned6d ago
Timeline
1 articles · newest firstAppears with
- Chocolateyproduct · 1
- Zscalerorganization · 1
- ArmorStealmalware · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.