Hackers are spreading a Python-based malware kit called ArmorSteal through fake software download pages. The kit steals passwords, crypto wallets and Discord accounts, and it also mines Monero in the background.
Seqrite Labs found a newer build of the kit on an infected Windows machine and rebuilt its full logic.
ArmorSteal malware
ArmorSteal reaches victims through search results. Zscaler ThreatLabz reported on 22 October 2026 that the operators built fake sites posing as the Chocolatey package manager and the Microsoft Activation Scripts tool.
People who search for install steps land on lookalike domains such as choclatey[.]org and massgravel[.]net. The page tells them to paste a PowerShell command.
The command does install the real tool, so everything seems normal. In the background, it also drops the malware into C:WindowsSystemHealthUpdate, a name picked to look like a normal Windows folder.
This tactic is not new. Cyber Security News recently covered how fake software downloads quietly hijack Windows PCs and turn them into a source of income for attackers.
According to technical research published by Seqrite Labs, the team noticed three scheduled tasks named SysCheck2, SysCheckX and SysHeal, all pointing at that folder. The kit ships with its own copy of Python 3.11, so it runs on any Windows machine.
Every script is protected with the trial version of PyArmor, which leaves nothing readable on disk. The trial runtime carries its decryption key, so researchers could unpack every script with the open-source Pyarmor-Static-Unpack-1shot tool.
SysCheck2 starts the main controller, SysMon.py, at every logon through a hidden console. SysCheckX launches the miner manager, xm_handler.py, as SYSTEM 45 seconds after boot.
SysHeal is new in this build and ran the controller once as SYSTEM on 27 September 2026. Each part holds its own list of command servers, so killing one process does not stop the others.
The controller builds a victim ID from the motherboard serial number. It then tries 11 domains in order, including pymons[.]is, workerstats[.]net and datamons[.]org.
The domain seen on the infected machine was only seventh in the list, so blocking it alone does very little. Zscaler’s build had only four domains, which shows the operators keep growing the setup.
Before it does anything visible, the malware checks its network owner through ipinfo.io. If the owner is Google, Amazon, Microsoft or Azure, it shows a fake “Memory is insufficient” error and quits.
Many sandboxes run on those clouds, so they never see the payloads. The malware also runs code from the server only if it carries a valid signature from the attacker’s RSA-2048 key. Nobody else can take over the botnet, even if they seize a domain.
The miner manager downloads xmrig-v4-3333.zip, checks its SHA-256 hash and unpacks it. Seqrite could not see the coin or wallet because the zip was gone, but the older build mined Monero. Every minute, the script adds C:Windows as a Defender exclusion, which hides the whole kit from scanning. That exclusion stays behind even after cleanup.
The best trick is how the miner avoids notice. Once a second, it looks for 20 monitoring tools, including Task Manager, Process Explorer, Process Hacker and Wireshark. If one is open, the miner shuts down at once, so a user checking why the fan is loud sees a quiet machine.
Mining restarts about a second after the tool closes. If xmrig.exe is removed, the script waits longer before each reinstall, from 2 minutes up to 6 hours, to avoid repeated alerts. On the infected machine, only the WinRing0x64.sys driver was left behind.
A similar driver showed up in a registry-hidden XMRig campaign we covered in September.
The spy module, basrq.py, logs every key along with the window title, so each password can be matched to a site. It checks the clipboard twice a second and swaps copied crypto addresses for the attacker’s.
Nine address types are covered, including Bitcoin, Ethereum, Solana and Monero. It also takes in-memory screenshots when chosen keywords appear. Extra scripts show fake Exodus, MetaMask and Phantom alerts, such as “You received 18.2 SOL”, to push victims into unlocking their wallets while the keylogger runs.
The stealer, got.py, takes Discord tokens from four Discord apps and 18 Chromium-based browsers. A token lets an attacker sign in without the password or 2FA. It copies data from about 20 wallet extensions and 13 desktop wallets.
It also scans every drive for BIP-39 seed phrases and zips matches as seeds.zip. To get around Chrome’s App-Bound Encryption, it downloads the public ChromElevator tool, which the author says exists for research.
It also hunts for vaults from KeePass, 1Password, Bitwarden, Dashlane, RoboForm and Enpass. This browser-protection bypass is spreading, as in the Marsalek malware hidden in fake game cheats.
When Seqrite checked on 31 October 2026, only pymons[.]is and datamons[.]org still resolved. Datamons[.]org shows a bland decoy page for “SPC Data Services.”
File hashes are a weak signal, because each PyArmor rebuild changes them. Look for behavior instead, such as Python running from under C:Windows, launched by scheduled tasks, adding Defender exclusions and starting a miner.
Defenders should hunt for the SysCheck2, SysCheckX and SysHeal tasks and the SystemHealthUpdate folder. They should also remove any Defender exclusion for C:Windows and block all 11 domains, not just one.
Users should never paste PowerShell commands from search results and should type official URLs by hand. Anyone who ran such a command should treat their passwords, tokens and wallet seeds as stolen and change them from a clean device.
