Hackers Use Fake Chocolatey and Microsoft Activation Websites to Spread New Armorsteal Malware

Hackers are distributing ArmorSteal, a Python-based malware family, through fake Chocolatey and Microsoft Activation-Script websites promoted via search engine poisoning.

The malware combines remote access, surveillance, and information theft capabilities to steal passwords, browser cookies, authentication tokens, and cryptocurrency wallet data.

Zscaler’s Threat Hunting team identified the campaign in September 2026 and published its findings on October 22. The operation targets users searching for installation commands, turning routine software setup into an infection pathway.

Hackers Use Fake Chocolatey and Microsoft Activation Websites

The typosquatted domain choclatey[.]org impersonated Chocolatey and displayed a malicious PowerShell installation command. Executing it deployed ArmorSteal while also running the legitimate Chocolatey installer, allowing the requested package manager to function normally and reducing visible signs of compromise.

A second domain, massgravel[.]net, impersonated the Microsoft Activation Scripts project. Shared malware components and an identical RSA-2048 task-signing key linked both distribution channels to the same operation.

Both installers request elevated privileges, hide the PowerShell console, and download an archive into C:WindowsSystemHealthUpdate. The package contains Python 3.11, Pyarmor runtime files, and malicious scripts protected with Pyarmor 9.1.7.

Persistence uses two scheduled tasks. SysCheck2 launches the remote access module at user logon with the highest available privileges. SysCheckX executes it as SYSTEM, following a 45-second delay after startup.

The remote access module, SysMon.py, profiles infected systems and derives a machine identifier from the motherboard serial number. It polls command-and-control servers every 60 seconds for victim-specific and campaign-wide Python tasks.

Before executing tasks in memory, the module verifies RSA-2048 signatures and compares version numbers against locally stored values, preventing older or previously processed instructions from running again.

ArmorSteal queries ipinfo[.]io for public IP ownership. When selected cloud providers appear in the organization field, it displays a fake memory error and exits, potentially evading cloud-hosted analysis environments.

The basrq.py surveillance module logs keystrokes and window titles, checks clipboard contents every half-second, and replaces cryptocurrency addresses. It also captures keyword-triggered screenshots and displays fake Exodus, MetaMask, and Phantom transaction notifications.

The got.py stealer targets browser passwords, autofill records, credit card metadata, SSH keys, Steam sessions, and password manager data. It validates tokens from 22 Discord client variants and collects information from 21 wallet extensions and desktop applications.

Zscaler said browser cookies are extracted through Chrome DevTools Protocol on port 9222, while additional routines search drives for BIP39 recovery phrases.

Although both lure sites went offline, operators shifted infrastructure toward pymons[.]is and datamons[.]org. Defenders should investigate the scheduled tasks, inspect the SystemHealth directory, review PowerShell downloads, monitor browser remote-debugging activity, and remove unauthorized Microsoft Defender exclusions.

IOCs

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team