SEO poisoning campaign delivers new Armorsteal malware
Original title: SEO Poisoning Campaign Delivers New Armorsteal Malware
Fake Chocolatey and Massgrave sites installed a Python remote-access module that steals system data and runs signed tasks.
Zscaler ThreatLabz says two SEO-poisoned sites impersonating Chocolatey and Microsoft Activation Scripts installed Armorsteal. A PowerShell installer drops a Pyarmor-protected Python remote-access module that persists with scheduled tasks, collects host details, and polls HTTPS command-and-control for RSA-signed tasks. The fake Massgrave site went down on September 25, 2026, and the fake Chocolatey site around October 1.
- Lures used choclatey[.]org and massgravel[.]net.
- Installers request elevation and hide the PowerShell window.
- Payloads land under C:\Windows\SystemHealth\Update\ with Python 3.11.
- Tasks SysCheck2 and SysCheckX relaunch the module at logon and boot.
- The module exits if ipinfo.io names Google, Amazon, Microsoft, or Azure.
Impact: Remote access plus host profiling and follow-on surveillance modules
- 1.Hunt for tasks SysCheck2 and SysCheckX and files under C:\Windows\SystemHealth\Update\.
- ATT&CK
- T1608.006 SEO PoisoningT1059.001 PowerShellT1053.005 Scheduled TaskT1027 Obfuscated Files or InformationT1071.001 Web Protocols
- Malware
- Armorsteal
- Organizations
- Zscaler ThreatLabz
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | choclatey.org | cted. The fake Chocolatey website and the malicious domain, choclatey[.]org , are shown below: Figure 2: Fake Chocolatey website dist |
| domain | chocolatey.org | tey PowerShell” may reach a typosquatted site impersonating chocolatey[.]org. The site displays a PowerShell installation command. Whe |
| domain | massgravel.net | t,” or “Massgrave activation”. These users may have reached massgravel[.]net , a malicious website impersonating the Microsoft Activat |
| domain | workerstats.net | mation to its C2 server. POST /receive_infof HTTP/1.1 Host: workerstats[.]net User-Agent: python-requests/2.31.0 Content-Type: applicat |
| sha256 | c1146fbcaa433385839c25839a61cd7fedaff858cc0d3fd063dba68db2cf31b4 | f a hardcoded string and uses the resulting 32-byte value ( c1146fbcaa433385839c25839a61cd7fedaff858cc0d3fd063dba68db2cf31b4 ) as an XOR key. The following example shows the Armorsteal |
From the original article
6 min read at zscaler.com
IntroductionIn September 2026, Zscaler Threat Hunting identified an SEO poisoning campaign that used fake websites impersonating the Chocolatey package manager and the Microsoft Activation Scripts (MAS) tool to distribute a Python-based malware family we track as Armorsteal. The fake websites targeted users searching for Chocolatey or MAS software installation commands.
By ThreatLabz (Zscaler) · zscaler.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.