# SEO Poisoning Campaign Delivers New Armorsteal Infostealer via Fake Chocolatey and Microsoft Activation Scripts Sites

> Zscaler ThreatLabz reports an SEO poisoning campaign using fake sites impersonating the Chocolatey package manager and Microsoft Activation Scripts (MAS) to deliver malicious PowerShell installers that deploy the new Armorsteal malware. Armorsteal combines a signed-task remote access module, a keylogger/clipboard-hijacking surveillance module and an infostealer targeting Discord tokens, browser data, crypto wallets, SSH keys, Steam sessions and password managers.

- **Published:** 2026-10-22T16:29:16Z
- **Last reviewed:** 2026-10-22T16:29:16Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4162
- **ID:** TL-2026-4162
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 27 (full data via the Threadlinqs MCP server — Purple tier)

## Description

In September 2026 Zscaler Threat Hunting identified an SEO poisoning campaign in which users searching for terms such as "chocolatey install windows" or "Microsoft Activation Scripts" were directed to lookalike sites: choclatey[.]org (registered 2026-09-01) impersonating Chocolatey and massgravel[.]net (registered 2026-08-30) impersonating the MAS/Massgrave project. Both lures serve a malicious install.ps1 that requests elevation, hides the PowerShell window, downloads a ZIP archive to C:\Windows\SystemHealth\Update\, runs a legitimate piece of software to avoid suspicion, and unpacks a Python 3.11 runtime together with Pyarmor-protected (Pyarmor 9.1.7 trial) Python scripts.

Persistence is established with two scheduled tasks: SysCheck2 (user logon, highest privileges) and SysCheckX (system boot, SYSTEM, 45-second delay), both launching the remote access module SysMon.py. SysMon.py exits if ipinfo.io reports a Google, Amazon, Microsoft or Azure organization (cloud sandbox evasion), collects host details including the motherboard serial number used as machine ID, and communicates over HTTPS with a hardcoded list of four C2 domains (user agent python-requests/2.31.0). It checks /downloadables/configf.json, posts host data to /receive_infof, and polls every 60 seconds for per-victim tasks (/get-onetime-code/{machine_id}) and global tasks (/get-global). Every task is verified against an embedded RSA-2048 public key before execution; version files (onetime_version.txt, global_version.txt) prevent replay. Global tasks can replace SysMon.py (SHA256-verified) and update the C2 list.

SysMon.py downloads two further modules. basrq.py is a surveillance module: multi-language keylogging with window titles, clipboard monitoring every 0.5 s with replacement of cryptocurrency wallet addresses (Bitcoin, Litecoin, Monero, Ethereum, TRON, XRP, Dogecoin, TON, Solana), keyword-triggered screenshots, and fake Exodus/MetaMask/Phantom transaction notifications. Keylogs are gzip-compressed (keylogs.gz) and screenshots XOR-encrypted with the SHA256 digest of a hardcoded string, uploaded to /black-watch/ endpoints. got.py is the stealer: it targets 22 Discord client variants, 21 wallet extensions/desktop apps, BIP39 seed phrases found by searching drives A: to Z:, browser cookies via Chrome DevTools Protocol on port 9222, saved passwords (using the public Chrome App-Bound Encryption chrome-decryptor tool), autofill and card metadata, password managers (KeePass, 1Password, RoboForm, Password Safe, Enpass, Bitwarden, Dashlane), SSH keys and Steam session data, and exfiltrates to /infame/receive/zip, /infame/receive/dt, /ws/{machine_id}, /pwd and /upload/st.

Infrastructure evolved over time: the primary C2 workerstats[.]net was registered 2026-01-28, with standby domains datamons[.]org (2026-05-19), supertrap[.]net (2026-08-29) and niceer[.]net (2026-09-01). The fake Massgrave site was taken down 2026-09-25 and the fake Chocolatey site 2026-10-01; in early October the operators shifted to pymons[.]is and reactivated datamons[.]org, with a phase 2 lure host and C2 on new IPs and token-gated /C2/?t=[token]451 and 452 requests returning /p/[32hex].zip. Zscaler's infrastructure analysis indicates a single coordinated operation; no threat actor is attributed. BeaconBeagle lookups for workerstats.net and 186.2.175.183 returned no matches at research time.

## MITRE ATT&CK

- T1608 Stage Capabilities
- T1583 Acquire Infrastructure
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1053 Scheduled Task/Job
- T1027 Obfuscated Files or Information
- T1497 Virtualization/Sandbox Evasion
- T1112 Modify Registry
- T1082 System Information Discovery
- T1056 Input Capture
- T1539 Steal Web Session Cookie
- T1555 Credentials from Password Stores
- T1552 Unsecured Credentials
- T1113 Screen Capture
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1573 Encrypted Channel

## Sources

- [SEO Poisoning Campaign Delivers New Armorsteal Malware (Zscaler ThreatLabz)](https://www.zscaler.com/blogs/security-research/seo-poisoning-campaign-delivers-new-armorsteal-malware)
- [BeaconBeagle config search: workerstats.net (no matches)](https://beaconbeagle.com/api/v1/configs/search?domain=workerstats.net)
- [MITRE ATT&CK T1608.006 SEO Poisoning](https://attack.mitre.org/techniques/T1608/006/)
- [MITRE ATT&CK T1053.005 Scheduled Task](https://attack.mitre.org/techniques/T1053/005/)
- [MITRE ATT&CK T1115 Clipboard Data](https://attack.mitre.org/techniques/T1115/)
- [Chocolatey official site](https://chocolatey.org/install)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4162