Threat reportMalwareTL-2026-5411

Armorsteal: Python Malware Kit Delivered via SEO-Poisoned Fake Download Pages Steals Data and Mines Crypto

highACTIVE

Armorsteal is a PyArmor-protected Python malware kit that steals browser credentials, password-manager vaults, Discord tokens and crypto wallets/seed phrases, hijacks clipboard crypto addresses, and mines cryptocurrency with XMRig on Windows hosts. Victims reach it through SEO-poisoned fake Chocolatey and Microsoft Activation Scripts download pages that serve a malicious PowerShell install command. First disclosed 2026-10-22.

Key facts for Armorsteal Python stealer

Identifiers	TL-2026-5411
Also known as	Armorsteal
Severity	HIGH
First disclosed	2026-10-22
Exploitation status	Exploited in the wild
Affected products	Microsoft Windows
Malware	Python, xmrig
Tools	ChromElevator
MITRE ATT&CK techniques	T1005 Data from Local System, T1008 Fallback Channels, T1027.013 Encrypted/Encoded File, T1036.004 Masquerade Task or Service, T1036.005 Masquerading, T1041 Exfiltration Over C2 Channel, T1053.005 Scheduled Task, T1056.001 Keylogging, T1057 Process Discovery, T1059.001 PowerShell, T1059.006 Python, T1070.004 File Deletion and 19 more in the attack flow
Motivation	FINANCIAL
Target sectors	consumer, cryptocurrency, technology, general
Target regions	Global
Detection rules	9 (1 shown free)
Sources	5 cited sources

Detection coverage for Armorsteal Python stealer

As of 2026-11-06, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5411 across Splunk SPL, Microsoft KQL and Sigma, covering 32 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Armorsteal Bundled Python Executing From C:\Windows\SystemHealth\Update

Detects Armorsteal (TL-2026-5411) execution: the bundled portable Python 3.11 interpreter, or the SysMon.py / xm_handler.py / pyarmor_runtime modules, launched from the C:\Windows\SystemHealth\Update install directory dropped by the malicious install.ps1. Behaviour-first: it keys on the odd location (a Python runtime under a fake system-health folder) and does not depend on C2 infrastructure that rotates.

Languages: Splunk SPL, Microsoft KQL, Sigma
ATT&CK: T1059.006, T1036.004, T1027.013
Data sources: sysmon, windows_security
Severity: high
Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h (Image="*SystemHealth*Update*" OR CommandLine="*SystemHealth*Update*") (Image="*python.exe" OR Image="*pythonw.exe" OR CommandLine="*SysMon.py*" OR CommandLine="*xm_handler.py*" OR CommandLine="*pyarmor_runtime*") | eval armorsteal_module=case(like(CommandLine,"%SysMon.py%"),"SysMon.py controller",like(CommandLine,"%xm_handler.py%"),"xm_handler.py XMRig manager",true(),"python from SystemHealth Update dir") | stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines values(ParentImage) as parent_images values(User) as users by host Image armorsteal_module | convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where FolderPath has @'\SystemHealth\Update' or ProcessCommandLine has @'\SystemHealth\Update'
| where FileName in~ ('python.exe', 'pythonw.exe') or ProcessCommandLine has_any ('SysMon.py', 'xm_handler.py', 'pyarmor_runtime')
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| order by Timestamp desc

Sigma

title: Armorsteal Python Runtime Executing From SystemHealth Update Directory
id: 5b0c6f1e-3a52-4d0e-9c1a-7f41a2d8e601
status: experimental
description: Detects the bundled portable Python interpreter or Armorsteal modules (SysMon.py, xm_handler.py, pyarmor_runtime) executing from the C:\Windows\SystemHealth\Update directory used by the Armorsteal kit.
references:
    - https://www.seqrite.com/blog/11421-2/
    - https://www.zscaler.com/blogs/security-research/seo-poisoning-campaign-delivers-new-armorsteal-malware
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-06
tags:
    - attack.execution
    - attack.t1059.006
    - attack.defense-evasion
    - attack.t1036.004
    - attack.t1027.013
logsource:
    category: process_creation
    product: windows
detection:
    selection_dir:
        - Image|contains: '\SystemHealth\Update\'
        - CommandLine|contains: '\SystemHealth\Update\'
    selection_py:
        - Image|endswith:
              - '\python.exe'
              - '\pythonw.exe'
        - CommandLine|contains:
              - 'SysMon.py'
              - 'xm_handler.py'
              - 'pyarmor_runtime'
    condition: selection_dir and selection_py
falsepositives:
    - A legitimate internal tool deliberately installed under a SystemHealth\Update path
level: high

Known false positives:

An internal IT tool or vendor agent that legitimately ships a Python runtime under a folder named SystemHealth\Update
Security researchers or sandbox hosts detonating the Armorsteal sample on purpose

Tuning notes: Requires Sysmon EventCode 1 with command-line logging. If your Sysmon data uses a different index name, change index=sysmon. Any hit is high fidelity because C:\Windows\SystemHealth\Update is not a standard Windows path; exclude a known-good path only after confirming it is a sanctioned internal tool.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)

Armorsteal PowerShell Install Command From SEO-Poisoned Lure Sites · unlock with TL Creds
Armorsteal Defender Exclusions and XMRig Miner Artifacts · unlock with TL Creds
Armorsteal Python Implant Geolocation Sandbox Check and C2 Beaconing · unlock with TL Creds
Armorsteal Kit Files Written To SystemHealth Update Directory · unlock with TL Creds
Armorsteal ChromElevator Browser Credential and Cookie Theft · unlock with TL Creds
Armorsteal C2 Exfiltration and Tasking URI Patterns In Proxy Logs · unlock with TL Creds
Armorsteal Scheduled Task Persistence ([indicator] / SysCheckX / SysHeal) and Headless conhost Launcher · unlock with TL Creds
Armorsteal C2 Failover Domain and IP Contact From Endpoint · unlock with TL Creds

Indicators of compromise for Armorsteal Python stealer

As of 2026-11-06, Threadlinqs Intelligence tracks 32 indicators of compromise for TL-2026-5411.

Sample indicators (3 of 32)

IP address: 186.2.175[.]158
Domain: choclatey[.]org
File hash: 972fe9edb13da76113047e6db39bcc44749aaeec1be107c975649f0c413a3067

Defanged, TLP:CLEAR. Full set of 32 indicators: unlock with TL Creds.

32 indicators of compromise · unlock with TL Creds. Compare plans

How Armorsteal Python stealer works

Armorsteal was identified by Zscaler Threat Hunting in September 2026 and analyzed in depth by Seqrite Labs (published 2026-11-06). Delivery relies on SEO poisoning: fake sites impersonating the Chocolatey package manager (choclatey.org) and Microsoft Activation Scripts (massgravel.net) rank for searches on those tools and display a PowerShell command. The command fetches an install.ps1 that installs the legitimate software while covertly dropping the kit, which includes a bundled portable Python 3.11, to C:\Windows\SystemHealth\Update\. Installer hosts reported by Zscaler were 82.153.135.80 and 209.99.186.187.

Persistence uses three scheduled tasks masquerading as system health routines: SysCheck2 (launches SysMon.py at user logon through a headless conhost.exe), SysCheckX (starts xm_handler.py as SYSTEM 45 seconds after boot) and SysHeal (SYSTEM-level controller task, reported by Seqrite as registered on 2026-09-27). All Python modules are protected with trial PyArmor 9.1.7, with the key embedded in pyarmor_runtime.pyd. Seqrite recovered the code with the open-source Pyarmor-Static-Unpack-1shot tool.

SysMon.py is the controller/backdoor. It derives a victim ID from the motherboard serial number and fails over across 11 C2 domains in priority order. It fetches /downloadables/configf.json and exits if ipinfo.io geolocation shows Google, Amazon, Microsoft or Azure hosting (sandbox/cloud evasion). It executes RSA-2048-signed remote Python code via exec(), downloads spy and stealer packages with SHA-256 verification, and polls every 60 seconds for /global.txt (broadcast code) and /get-onetime-code/<victim_id> (targeted payloads). datamons.org shows a decoy 'SPC Data Services' landing page, and C2 file requests redirect to a login portal.

xm_handler.py manages an XMRig miner (xmrig-v4-3333.zip, unpacked to xmrig-v2\, with the WinRing0x64.sys driver). It adds Windows Defender exclusions for the C:\Windows path and the xmrig.exe process and rechecks them every 60 seconds. It stops mining when about 20 monitoring tools (Task Manager, Process Explorer, Process Hacker, System Informer, Wireshark and others) are open, kills such tools if left open for over an hour, and uses exponential backoff (2 to 4 to 8 minutes, up to 6 hours) if the miner is removed.

The spy module (nig\basrq.py) logs keystrokes with window titles and uploads them every minute. It monitors the clipboard twice per second and swaps cryptocurrency addresses (Bitcoin, Litecoin, Ethereum, Tron, XRP, Dogecoin, TON, Solana, Monero) for attacker wallets. It shows fake Exodus, MetaMask and Phantom notifications and takes in-memory screenshots when downloaded keywords match. The stealer module (getthem\got.py) steals Discord tokens from the Discord apps and 18 Chromium browsers (dt.py). It copies about 20 wallet browser extensions and 13 desktop wallets and scans all drives for text files holding BIP-39 seed phrases (wc.py). It bypasses Chrome App-Bound Encryption with the public ChromElevator v0.17.4 tool to collect passwords, cookies, autofill data and SSH keys (ac.py). It harvests KeePass, 1Password, Bitwarden, Dashlane, RoboForm, PasswordSafe and Enpass vaults (pms.py) and collects system and network information with geolocation via ip-api.com (sic.py, getst.py, newst.py). Data is exfiltrated by HTTPS POST to C2 paths /infame/receive/dt, /infame/receive/zip and /ws/<victim_id>. Staging directories and archives are deleted afterward.

No actor attribution is made in the sources. Severity is analyst-assigned and CVSS is not applicable (no CVE). The sources do not disclose attacker wallet addresses or the mining pool.

MITRE ATT&CK techniques by tactic:

Remediation for Armorsteal Python stealer

Immediate actions

Block the Armorsteal C2 domains and IPs (pymons.is, pur.st, workerstats.net, niceer.net, plaineagle.xyz, univalley.top, datamons.org, supertrap.net, icedhatch.top, icedhatch.xyz, icedout.top) and the fake download domains choclatey.org and massgravel.net
Hunt for scheduled tasks SysCheck2, SysCheckX and SysHeal and the directory C:\Windows\SystemHealth\Update\
Hunt for Defender exclusions on C:\Windows and xmrig.exe, and for xmrig.exe or WinRing0x64.sys on endpoints
On confirmed infection: isolate the host, rotate all browser-saved, password-manager and Discord credentials and tokens, invalidate sessions, and move crypto assets to freshly generated wallets and seed phrases

Workarounds

Use application allow-listing to block unsigned Python runtimes and pyarmor_runtime.pyd outside approved paths
Enforce web filtering for newly registered and typosquatted domains

Longer-term hardening

Educate users never to paste PowerShell commands from search-result pages; install tools only from official vendor sites or verified package sources
Alert on powershell.exe fetching and executing remote install.ps1 scripts and on Python interpreters running from C:\Windows subdirectories
Restrict modification of Defender exclusions via tamper protection and monitor Add-MpPreference activity
Do not store seed phrases in plaintext files on endpoints

Affected and fixed versions

Microsoft — Windows
Vulnerable versions: Windows hosts where the user runs the malicious PowerShell install command

Timeline of Armorsteal Python stealer

Last updated 2026-11-06 · revalidated 1× · latest source

2026-01-28 C2 domain locked-ioc-11 registered (Zscaler)
2026-05-19 C2 domain locked-ioc-27 registered (Zscaler)
2026-08-29 C2 domain locked-ioc-17 registered (Zscaler)
2026-08-30 Fake Microsoft Activation Scripts lure domain locked-ioc-12 registered (Zscaler)
2026-09-01 Fake Chocolatey lure domain locked-ioc-15 and C2 domain locked-ioc-29 registered (Zscaler)
2026-09-25 Fake Massgrave site locked-ioc-12 taken down (Zscaler)
2026-09-27 SysHeal scheduled task registered on an analyzed system (Seqrite)
2026-10-01 Fake Chocolatey site locked-ioc-15 taken down (Zscaler)
2026-10-22 Zscaler ThreatLabz publishes 'SEO Poisoning Campaign Delivers New Armorsteal Malware', following a September 2026 hunt that identified the campaign
2026-10-28 Pyarmor 9.1.7 trial build timestamp (2026-10-28T12:56:58) embedded in the analyzed Armorsteal scripts (Seqrite).
2026-10-31 Seqrite analyzes the sample; only locked-ioc-30 and locked-ioc-27 still resolve.
2026-11-06 Seqrite Labs publishes a full technical breakdown of the Armorsteal kit (SysMon.py, xm_handler.py, spy and stealer modules)

Update history

2026-11-06 — Armorsteal: Python-based infostealer and XMRig crypto-miner kit distributed via SEO-poisoned fake tool download pages: What changed No severity, exploitability, status or attribution change. Record enriched with additional capabilities (Steam session and SSH key theft, extra C2 endpoints /pwd, /upload/st, /black-watch/<victim_id , Chrome DevTools Protocol o

Sources cited for Armorsteal Python stealer

Armorsteal Unpacked: Breaking Down a Python Malware Kit That Steals Data and Mines Crypto (Seqrite) seqrite.com · Research · 2026-11-06
SEO Poisoning Campaign Delivers New Armorsteal Malware (Zscaler ThreatLabz) zscaler.com · Vendor report · 2026-10-22
MITRE ATT&CK T1053.005 Scheduled Task MITRE · Research
MITRE ATT&CK T1496.001 Compute Hijacking MITRE · Research
Pyarmor-Static-Unpack-1shot (tool used to unpack PyArmor-protected scripts) GitHub · Code repository

Drafted by the Threadlinqs research pipeline from 5 sources; published 2026-11-06; last updated 2026-11-06.

Armorsteal: Python Malware Kit Delivered via SEO-Poisoned Fake Download Pages Steals Data and Mines Crypto

Key facts for Armorsteal Python stealer

Detection coverage for Armorsteal Python stealer

Free detection: Armorsteal Bundled Python Executing From C:\Windows\SystemHealth\Update

Splunk SPL

Microsoft KQL

Sigma

Indicators of compromise for Armorsteal Python stealer

Sample indicators (3 of 32)

How Armorsteal Python stealer works

Collection

Command and Control

Defense Evasion

Exfiltration

Persistence

Discovery

Execution

Impact

Credential Access

Resource Development

defense-impairment

Remediation for Armorsteal Python stealer

Immediate actions

Workarounds

Longer-term hardening

Affected and fixed versions

Timeline of Armorsteal Python stealer

Update history

Sources cited for Armorsteal Python stealer

Latest Threats

🔄 Threat Comparison

Armorsteal: Python Malware Kit Delivered via SEO-Poisoned Fake Download Pages Steals Data and Mines Crypto

Key facts for Armorsteal Python stealer

Detection coverage for Armorsteal Python stealer

Free detection: Armorsteal Bundled Python Executing From C:\Windows\SystemHealth\Update

Splunk SPL

Microsoft KQL

Sigma

Indicators of compromise for Armorsteal Python stealer

Sample indicators (3 of 32)

How Armorsteal Python stealer works

Collection

Command and Control

Defense Evasion

Exfiltration

Persistence

Discovery

Execution

Impact

Credential Access

Resource Development

defense-impairment

Remediation for Armorsteal Python stealer

Immediate actions

Workarounds

Longer-term hardening

Affected and fixed versions

Timeline of Armorsteal Python stealer

Update history

Sources cited for Armorsteal Python stealer

More in malware

Latest Threats

🔄 Threat Comparison