SEO Poisoning Campaign Delivers New Armorsteal Malware

IntroductionIn September 2026, Zscaler Threat Hunting identified an SEO poisoning campaign that used fake websites impersonating the Chocolatey package manager and the Microsoft Activation Scripts (MAS) tool to distribute a Python-based malware family we track as Armorsteal. The fake websites targeted users searching for Chocolatey or MAS software installation commands. Each lure page displayed a malicious PowerShell command that downloaded and executed the Armorsteal installer. The installer deployed a Python 3.11 runtime environment and three main components providing remote access, surveillance, and information stealing capabilities, with the Python code protected by Pyarmor.The remote access component communicates with a command-and-control (C2) server, downloads additional modules, and executes remote tasks. The surveillance component logs keystrokes, monitors the clipboard, captures screenshots, and displays fake cryptocurrency wallet notifications. The information stealing component targets browser data, Discord tokens, cryptocurrency wallets, seed phrases, saved passwords, SSH keys, and Steam data.In this blog post, the Zscaler Threat Hunting team traces the campaign from poisoned search results through post-infection activity, including Armorsteal's components, C2 communication, and infrastructure changes observed during our analysis. Key TakeawaysIn September 2026, the Zscaler Threat Hunting team identified an SEO poisoning campaign that distributed Armorsteal through websites impersonating Chocolatey and the Microsoft Activation Scripts (MAS) tool.The SEO campaign targeted users searching for Chocolatey installation instructions or Microsoft activation scripts.The remote access component verifies RSA-2048 signatures on Python tasks received from the C2 server before executing them.The surveillance component records window titles, logs keystrokes, monitors copied cryptocurrency wallet addresses, and captures screenshots when configured keywords are detected.The information stealing component steals Discord tokens, browser cookies, saved passwords, cryptocurrency wallet data, BIP39 seed phrases, and SSH keys. Technical AnalysisThe following sections provide details about the malware distribution, capabilities, and network communications.SEO poisoningZscaler Threat Hunting identified two SEO poisoning lures that targeted users searching for Windows software installation instructions. One of those lures is shown in the figure below.Figure 1: Google search results for “chocolatey install windows”. Fake Chocolatey websiteThe first lure (seen in Figure 1) targets users looking for the Chocolatey package manager. A user searching for terms such as “install Chocolatey” and “Chocolatey PowerShell” may reach a typosquatted site impersonating chocolatey[.]org. The site displays a PowerShell installation command. When the user runs it, the malicious install.ps1 script downloads and installs the remote access module. The script also runs the legitimate Chocolatey installer, so Chocolatey appears to function as expected. The fake Chocolatey website and the malicious domain, choclatey[.]org, are shown below:Figure 2: Fake Chocolatey website distributing Armorsteal. Fake Massgrave websiteThe second lure targeted users searching for terms such as “Microsoft Activation Scripts,” “MAS activation script,” or “Massgrave activation”. These users may have reached massgravel[.]net, a malicious website impersonating the Microsoft Activation Scripts tool (a.k.a., the Massgrave project). The fake Massgrave website is shown in the figure below:Figure 3: Fake Massgrave website distributing Armorsteal.Although the two websites impersonate different projects and target different search queries, both deliver Armorsteal.ANALYST NOTE: The fake Massgrave website went down on September 25, 2026, and the fake Chocolatey website went down around October 1, 2026. Installation and persistenceBoth installer variants request elevated privileges, hide the PowerShell console window, and download a ZIP archive to C:\Windows\SystemHealth\Update\ to mimic a legitimate Windows system directory. The archive contains a Python 3.11 runtime, Pyarmor runtime files, and Armorsteal Python-based scripts.The installer creates the following scheduled tasks for persistence:Scheduled taskTriggerDescriptionSysCheck2User logonLaunches the remote access module with the highest privileges available.SysCheckXSystem bootLaunches the remote access module as SYSTEM after a 45-second delay.Table 1: Armorsteal scheduled task persistence.Anti-analysis techniquesArmorsteal uses the following techniques to avoid research environments and complicate analysis:The remote access module checks the public IP address and organization information using ipinfo[.]io. If the organization name returned matches a cloud provider such as Google, Amazon, Microsoft, or Azure, the module displays a fake “Memory is insufficient” message and exits. This can prevent the malware from

Read the original article:

SEO Poisoning Campaign Delivers New Armorsteal Malware