ArmorSteal steals credentials and mines Monero via fake downloads
Original title: Hackers Deploy ArmorSteal Malware Through Fake Software Downloads to Steal Credentials and Mine Crypto
Victims who paste a PowerShell command get a PyArmor-packed Python kit with three scheduled tasks and 11 command domains.
Seqrite Labs rebuilt a newer ArmorSteal build found on an infected Windows PC. Operators lure searches to fake Chocolatey and Microsoft Activation Scripts sites; a pasted PowerShell command installs the real tool and drops malware under C:\Windows\SystemHealth\Update. The kit keylogs, swaps crypto addresses, steals Discord tokens and wallets, and runs XMRig while hiding from monitoring tools and cloud sandboxes.
Unconfirmed: Seqrite could not confirm the coin or wallet in the missing miner archive; Monero mining is from the older build.
- Lookalike domains include choclatey[.]org and massgravel[.]net, Zscaler reported on October 22, 2026.
- Tasks SysCheck2, SysCheckX and SysHeal launch a bundled Python 3.11 kit.
- It adds a Defender exclusion for C:\Windows every minute and pauses mining if monitors are open.
- Clipboard swapping covers nine address types, including Bitcoin, Ethereum, Solana and Monero.
- On October 31, 2026, only pymons[.]is and datamons[.]org still resolved.
Impact: Steals passwords, wallets and Discord tokens; mines Monero
- 1.Hunt for SysCheck2, SysCheckX and SysHeal and the SystemHealth\Update folder.
- 2.Remove any Defender exclusion for C:\Windows and block all 11 command domains.
- 3.Change passwords, tokens and wallet seeds from a clean device if the command was run.
- ATT&CK
- T1059.001 Command and Scripting Interpreter: PowerShellT1053.005 Scheduled Task/Job: Scheduled TaskT1056.001 Input Capture: KeyloggingT1115 Clipboard DataT1496 Resource Hijacking
- Vendors
- Microsoft
- Malware
- ArmorStealXMRigPyArmor
- Organizations
- Seqrite LabsZscaler ThreatLabz
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | choclatey.org | search for install steps land on lookalike domains such as choclatey[.]org and massgravel[.]net. The page tells them to paste a Powe |
| domain | datamons.org | ains in order, including pymons[.]is, workerstats[.]net and datamons[.]org. The domain seen on the infected machine was only seventh |
| domain | massgravel.net | steps land on lookalike domains such as choclatey[.]org and massgravel[.]net. The page tells them to paste a PowerShell command. The c |
| domain | pymons.is | serial number. It then tries 11 domains in order, including pymons[.]is, workerstats[.]net and datamons[.]org. The domain seen on |
| domain | workerstats.net | . It then tries 11 domains in order, including pymons[.]is, workerstats[.]net and datamons[.]org. The domain seen on the infected machi |
From the original article
4 min read at cybersecuritynews.com
Hackers are spreading a Python-based malware kit called ArmorSteal through fake software download pages. The kit steals passwords, crypto wallets and Discord accounts, and it also mines Monero in the background. Seqrite Labs found a newer build of the kit on an infected Windows machine and rebuilt its full logic.
By Kavichselvan · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.