Threat reportMalwareTL-2026-4162
SEO Poisoning Campaign Delivers New Armorsteal Infostealer via Fake Chocolatey and Microsoft Activation Scripts Sites
SEO Poisoning Campaign Delivers New Armorsteal Infostealer (TL-2026-4162), also tracked as Armorsteal, is a high-severity malware campaign, first published 2026-10-22. It has no confirmed attribution, affects Microsoft Windows, maps to 17 MITRE ATT&CK techniques (T1005, T1027, T1053), and is covered by 9 detection rules and 27 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 17MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 27Indicators of compromise
Key facts for TL-2026-4162
- Threat ID
- TL-2026-4162
- Also known as
- Armorsteal
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- technology, cryptocurrency, gaming, consumer
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 27
Malware and tooling in SEO Poisoning Campaign Delivers New Armorsteal Infostealer
Malware and tooling: Armorsteal, Python
How SEO Poisoning Campaign Delivers New Armorsteal Infostealer works
Zscaler ThreatLabz reports an SEO poisoning campaign using fake sites impersonating the Chocolatey package manager and Microsoft Activation Scripts (MAS) to deliver malicious PowerShell installers that deploy the new Armorsteal malware. Armorsteal combines a signed-task remote access module, a keylogger/clipboard-hijacking surveillance module and an infostealer targeting Discord tokens, browser data, crypto wallets, SSH keys, Steam sessions and password managers.
In September 2026 Zscaler Threat Hunting identified an SEO poisoning campaign in which users searching for terms such as "chocolatey install windows" or "Microsoft Activation Scripts" were directed to lookalike sites: choclatey[.]org (registered 2026-09-01) impersonating Chocolatey and massgravel[.]net (registered 2026-08-30) impersonating the MAS/Massgrave project. Both lures serve a malicious install.ps1 that requests elevation, hides the PowerShell window, downloads a ZIP archive to C:\Windows\SystemHealth\Update\, runs a legitimate piece of software to avoid suspicion, and unpacks a Python 3.11 runtime together with Pyarmor-protected (Pyarmor 9.1.7 trial) Python scripts.
Persistence is established with two scheduled tasks: SysCheck2 (user logon, highest privileges) and SysCheckX (system boot, SYSTEM, 45-second delay), both launching the remote access module SysMon.py. SysMon.py exits if ipinfo.io reports a Google, Amazon, Microsoft or Azure organization (cloud sandbox evasion), collects host details including the motherboard serial number used as machine ID, and communicates over HTTPS with a hardcoded list of four C2 domains (user agent python-requests/2.31.0). It checks /downloadables/configf.json, posts host data to /receive_infof, and polls every 60 seconds for per-victim tasks (/get-onetime-code/{machine_id}) and global tasks (/get-global). Every task is verified against an embedded RSA-2048 public key before execution; version files (onetime_version.txt, global_version.txt) prevent replay. Global tasks can replace SysMon.py (SHA256-verified) and update the C2 list.
SysMon.py downloads two further modules. basrq.py is a surveillance module: multi-language keylogging with window titles, clipboard monitoring every 0.5 s with replacement of cryptocurrency wallet addresses (Bitcoin, Litecoin, Monero, Ethereum, TRON, XRP, Dogecoin, TON, Solana), keyword-triggered screenshots, and fake Exodus/MetaMask/Phantom transaction notifications. Keylogs are gzip-compressed (keylogs.gz) and screenshots XOR-encrypted with the SHA256 digest of a hardcoded string, uploaded to /black-watch/ endpoints. got.py is the stealer: it targets 22 Discord client variants, 21 wallet extensions/desktop apps, BIP39 seed phrases found by searching drives A: to Z:, browser cookies via Chrome DevTools Protocol on port 9222, saved passwords (using the public Chrome App-Bound Encryption chrome-decryptor tool), autofill and card metadata, password managers (KeePass, 1Password, RoboForm, Password Safe, Enpass, Bitwarden, Dashlane), SSH keys and Steam session data, and exfiltrates to /infame/receive/zip, /infame/receive/dt, /ws/{machine_id}, /pwd and /upload/st.
Infrastructure evolved over time: the primary C2 workerstats[.]net was registered 2026-01-28, with standby domains datamons[.]org (2026-05-19), supertrap[.]net (2026-08-29) and niceer[.]net (2026-09-01). The fake Massgrave site was taken down 2026-09-25 and the fake Chocolatey site 2026-10-01; in early October the operators shifted to pymons[.]is and reactivated datamons[.]org, with a phase 2 lure host and C2 on new IPs and token-gated /C2/?t=[token]451 and 452 requests returning /p/[32hex].zip. Zscaler's infrastructure analysis indicates a single coordinated operation; no threat actor is attributed. BeaconBeagle lookups for workerstats.net and 186.2.175.183 returned no matches at research time.
MITRE ATT&CK techniques used in TL-2026-4162
Collection
T1005 Data from Local System; T1113 Screen Capture
Defense Evasion
T1027 Obfuscated Files or Information; T1497 Virtualization/Sandbox Evasion
Persistence
Credential Access
T1056 Input Capture; T1539 Steal Web Session Cookie; T1552 Unsecured Credentials; T1555 Credentials from Password Stores
Execution
T1059 Command and Scripting Interpreter; T1204 User Execution
Command and Control
T1071 Application Layer Protocol; T1573 Encrypted Channel
Discovery
T1082 System Information Discovery
defense-impairment
Resource Development
Affected products and versions in SEO Poisoning Campaign Delivers New Armorsteal Infostealer
- Microsoft — Windows
Vulnerable versions: Windows endpoints where users run the malicious install.ps1
Remediation for SEO Poisoning Campaign Delivers New Armorsteal Infostealer
Immediate actions
- Block the Armorsteal C2 and lure domains (workerstats.net, pymons.is, datamons.org, niceer.net, supertrap.net, choclatey.org, massgravel.net) and associated IPs at DNS, proxy and firewall
- Hunt for the scheduled tasks SysCheck2 and SysCheckX and the directory C:\Windows\SystemHealth\Update\ and isolate matching hosts
- Reset Discord tokens, browser-saved credentials, SSH keys, Steam sessions and password manager master credentials on affected hosts, and move crypto funds to new wallets with fresh seed phrases
- Invalidate active browser sessions and cookies for accounts used on infected hosts
Workarounds
- Use trusted software sources and verify domain spelling (chocolatey.org) before running installer commands
Longer-term hardening
- Teach users to install Chocolatey and MAS only from official sources and never to run copy-pasted PowerShell from search results
- Alert on python-requests user agents and Python runtimes executing from C:\Windows paths, and on Python processes launched by scheduled tasks
- Monitor for chrome remote-debugging port 9222 use by non-browser processes
- Enforce PowerShell Constrained Language Mode / script logging and application control
Timeline of SEO Poisoning Campaign Delivers New Armorsteal Infostealer
- Primary C2 domain workerstats[.]net registered
- Standby C2 domain datamons[.]org registered
- Standby C2 domain supertrap[.]net registered
- Fake Massgrave/MAS lure domain massgravel[.]net registered
- Fake Chocolatey lure choclatey[.]org and standby C2 niceer[.]net registered
- Zscaler Threat Hunting identified the SEO poisoning campaign (September 2026; exact day not stated in source)
- Fake Massgrave website taken down
- Fake Chocolatey website taken down
- Early October 2026 (exact day not stated): operators shifted to pymons[.]is and reactivated datamons[.]org, with new lure host and C2 IPs
- Zscaler ThreatLabz published analysis of the Armorsteal malware
Sources cited for SEO Poisoning Campaign Delivers New Armorsteal Infostealer
Detection coverage for TL-2026-4162
As of 2026-10-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4162 across Splunk SPL, Microsoft KQL and Sigma, covering 27 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.