Skip to content
NewA calmer, faster ZeroHour
StoryMalwarehighExploited in the wild

ArmorSteal steals credentials and wallets while hiding a Monero miner

2 sources · 2 articlesFirst reported Updated ()
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

A PyArmor-packed Windows kit, installed through fake software downloads, steals credentials and crypto data and mines Monero while hiding from monitors.

ArmorSteal is a Python-based Windows malware kit that steals credentials, Discord tokens, and crypto-wallet data while running an XMRig Monero miner. Seqrite Labs rebuilt a newer build from an infected PC. Operators lure searches to typosquatted Chocolatey and Microsoft Activation Scripts sites; a pasted PowerShell command installs the real tool and drops malware under C:\Windows\SystemHealth\Update. Scheduled tasks persist a bundled Python 3.11 kit. It adds Defender exclusions, swaps clipboard wallet addresses, and pauses mining when monitoring tools or cloud sandboxes are detected. Zscaler previously reported related lookalike domains; by October 31 only two of 11 command domains still resolved.

Key facts
  • Tasks SysCheck2, SysCheckX, and SysHeal launch the Python 3.11 kit
  • Checks 20 monitoring tools, including Task Manager, and restarts mining after they close
  • Adds a Defender exclusion for C:\Windows every minute, including xmrig.exe
  • Clipboard swapping covers nine address types, including Bitcoin, Ethereum, Solana, and Monero
  • Lookalike domains include choclatey[.]org and massgravel[.]net
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 22, 2026Zscaler reported lookalike Chocolatey and activation domains · Cyber Security News
  2. Oct 31, 2026Only pymons[.]is and datamons[.]org still resolved · Cyber Security News

What each outlet adds

beyond the shared facts
  • GBHackersDrop path, 20 monitoring checks, and miner restart behavior
  • Cyber Security NewsSeqrite rebuild, three tasks, nine wallet types, and C2 status
Vendors
MicrosoftSeqrite
Products
WindowsChocolateyMicrosoft Activation ScriptsWindows Defender
Malware
ArmorStealXMRigPyArmor
Organizations
Seqrite LabsZscaler ThreatLabzZscaler

Coverage

oldest first · one row per article · UTC
  1. · 11h ago GBHackersFirst report

    ArmorSteal steals passwords, crypto wallets and hides miner

    ArmorSteal installs via Chocolatey lures and runs a stealth Monero miner that detects Task Manager.

  2. · 7h ago Cyber Security News

    ArmorSteal steals credentials and mines Monero via fake downloads

    Victims who paste a PowerShell command get a PyArmor-packed Python kit with three scheduled tasks and 11 command domains.