# Armorsteal: Python Malware Kit Delivered via SEO-Poisoned Fake Download Pages Steals Data and Mines Crypto

> Armorsteal is a PyArmor-protected Python malware kit that steals browser credentials, password-manager vaults, Discord tokens and crypto wallets/seed phrases, hijacks clipboard crypto addresses, and mines cryptocurrency with XMRig on Windows hosts. Victims reach it through SEO-poisoned fake Chocolatey and Microsoft Activation Scripts download pages that serve a malicious PowerShell install command.

- **Published:** 2026-11-06T12:14:18Z
- **Last reviewed:** 2026-11-06T12:37:55.858Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5411
- **ID:** TL-2026-5411
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 32 (3 shown free below)

## Description

Armorsteal was identified by Zscaler Threat Hunting in September 2026 and analyzed in depth by Seqrite Labs (published 2026-11-06). Delivery relies on SEO poisoning: fake sites impersonating the Chocolatey package manager (choclatey.org) and Microsoft Activation Scripts (massgravel.net) rank for searches on those tools and display a PowerShell command. The command fetches an install.ps1 that installs the legitimate software while covertly dropping the kit, which includes a bundled portable Python 3.11, to C:\Windows\SystemHealth\Update\. Installer hosts reported by Zscaler were 82.153.135.80 and 209.99.186.187.

Persistence uses three scheduled tasks masquerading as system health routines: SysCheck2 (launches SysMon.py at user logon through a headless conhost.exe), SysCheckX (starts xm_handler.py as SYSTEM 45 seconds after boot) and SysHeal (SYSTEM-level controller task, reported by Seqrite as registered on 2026-09-27). All Python modules are protected with trial PyArmor 9.1.7, with the key embedded in pyarmor_runtime.pyd. Seqrite recovered the code with the open-source Pyarmor-Static-Unpack-1shot tool.

SysMon.py is the controller/backdoor. It derives a victim ID from the motherboard serial number and fails over across 11 C2 domains in priority order. It fetches /downloadables/configf.json and exits if ipinfo.io geolocation shows Google, Amazon, Microsoft or Azure hosting (sandbox/cloud evasion). It executes RSA-2048-signed remote Python code via exec(), downloads spy and stealer packages with SHA-256 verification, and polls every 60 seconds for /global.txt (broadcast code) and /get-onetime-code/<victim_id> (targeted payloads). datamons.org shows a decoy 'SPC Data Services' landing page, and C2 file requests redirect to a login portal.

xm_handler.py manages an XMRig miner (xmrig-v4-3333.zip, unpacked to xmrig-v2\, with the WinRing0x64.sys driver). It adds Windows Defender exclusions for the C:\Windows path and the xmrig.exe process and rechecks them every 60 seconds. It stops mining when about 20 monitoring tools (Task Manager, Process Explorer, Process Hacker, System Informer, Wireshark and others) are open, kills such tools if left open for over an hour, and uses exponential backoff (2 to 4 to 8 minutes, up to 6 hours) if the miner is removed.

The spy module (nig\basrq.py) logs keystrokes with window titles and uploads them every minute. It monitors the clipboard twice per second and swaps cryptocurrency addresses (Bitcoin, Litecoin, Ethereum, Tron, XRP, Dogecoin, TON, Solana, Monero) for attacker wallets. It shows fake Exodus, MetaMask and Phantom notifications and takes in-memory screenshots when downloaded keywords match. The stealer module (getthem\got.py) steals Discord tokens from the Discord apps and 18 Chromium browsers (dt.py). It copies about 20 wallet browser extensions and 13 desktop wallets and scans all drives for text files holding BIP-39 seed phrases (wc.py). It bypasses Chrome App-Bound Encryption with the public ChromElevator v0.17.4 tool to collect passwords, cookies, autofill data and SSH keys (ac.py). It harvests KeePass, 1Password, Bitwarden, Dashlane, RoboForm, PasswordSafe and Enpass vaults (pms.py) and collects system and network information with geolocation via ip-api.com (sic.py, getst.py, newst.py). Data is exfiltrated by HTTPS POST to C2 paths /infame/receive/dt, /infame/receive/zip and /ws/<victim_id>. Staging directories and archives are deleted afterward.

No actor attribution is made in the sources. Severity is analyst-assigned and CVSS is not applicable (no CVE). The sources do not disclose attacker wallet addresses or the mining pool.

## MITRE ATT&CK

- T1583.001 Domains
- T1608 Stage Capabilities
- T1059.001 PowerShell
- T1059.006 Python
- T1053.005 Scheduled Task
- T1027.013 Encrypted/Encoded File
- T1036.004 Masquerade Task or Service
- T1685 Disable or Modify Tools
- T1564.003 Hidden Window
- T1497.001 System Checks
- T1070.004 File Deletion
- T1555.003 Credentials from Web Browsers
- T1555.005 Password Managers
- T1539 Steal Web Session Cookie
- T1528 Steal Application Access Token
- T1552.001 Credentials In Files
- T1056.001 Keylogging
- T1113 Screen Capture
- T1005 Data from Local System
- T1082 System Information Discovery
- T1057 Process Discovery
- T1071.001 Web Protocols
- T1008 Fallback Channels
- T1496.001 Compute Hijacking
- T1565.002 Transmitted Data Manipulation
- T1204.001 User Execution
- T1036.005 Masquerading
- T1552.004 Unsecured Credentials
- T1115 Clipboard Data
- T1041 Exfiltration Over C2 Channel
- T1657 Financial Theft

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Armorsteal Bundled Python Executing From C:\Windows\SystemHealth\Update** (`TL-2026-5411-SPL-001`)

Detects Armorsteal (TL-2026-5411) execution: the bundled portable Python 3.11 interpreter, or the SysMon.py / xm_handler.py / pyarmor_runtime modules, launched from the C:\Windows\SystemHealth\Update install directory dropped by the malicious install.ps1. Behaviour-first: it keys on the odd location (a Python runtime under a fake system-health folder) and does not depend on C2 infrastructure that rotates.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1059.006, T1036.004, T1027.013
- **Data sources:** sysmon, windows_security
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h (Image="*SystemHealth*Update*" OR CommandLine="*SystemHealth*Update*") (Image="*python.exe" OR Image="*pythonw.exe" OR CommandLine="*SysMon.py*" OR CommandLine="*xm_handler.py*" OR CommandLine="*pyarmor_runtime*") | eval armorsteal_module=case(like(CommandLine,"%SysMon.py%"),"SysMon.py controller",like(CommandLine,"%xm_handler.py%"),"xm_handler.py XMRig manager",true(),"python from SystemHealth Update dir") | stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines values(ParentImage) as parent_images values(User) as users by host Image armorsteal_module | convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FolderPath has @'\SystemHealth\Update' or ProcessCommandLine has @'\SystemHealth\Update'
| where FileName in~ ('python.exe', 'pythonw.exe') or ProcessCommandLine has_any ('SysMon.py', 'xm_handler.py', 'pyarmor_runtime')
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| order by Timestamp desc
```

### Sigma

```yaml
title: Armorsteal Python Runtime Executing From SystemHealth Update Directory
id: 5b0c6f1e-3a52-4d0e-9c1a-7f41a2d8e601
status: experimental
description: Detects the bundled portable Python interpreter or Armorsteal modules (SysMon.py, xm_handler.py, pyarmor_runtime) executing from the C:\Windows\SystemHealth\Update directory used by the Armorsteal kit.
references:
    - https://www.seqrite.com/blog/11421-2/
    - https://www.zscaler.com/blogs/security-research/seo-poisoning-campaign-delivers-new-armorsteal-malware
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-06
tags:
    - attack.execution
    - attack.t1059.006
    - attack.defense-evasion
    - attack.t1036.004
    - attack.t1027.013
logsource:
    category: process_creation
    product: windows
detection:
    selection_dir:
        - Image|contains: '\SystemHealth\Update\'
        - CommandLine|contains: '\SystemHealth\Update\'
    selection_py:
        - Image|endswith:
              - '\python.exe'
              - '\pythonw.exe'
        - CommandLine|contains:
              - 'SysMon.py'
              - 'xm_handler.py'
              - 'pyarmor_runtime'
    condition: selection_dir and selection_py
falsepositives:
    - A legitimate internal tool deliberately installed under a SystemHealth\Update path
level: high
```

**Known false positives:**

- An internal IT tool or vendor agent that legitimately ships a Python runtime under a folder named SystemHealth\Update
- Security researchers or sandbox hosts detonating the Armorsteal sample on purpose

**Tuning notes:** Requires Sysmon EventCode 1 with command-line logging. If your Sysmon data uses a different index name, change index=sysmon. Any hit is high fidelity because C:\Windows\SystemHealth\Update is not a standard Windows path; exclude a known-good path only after confirming it is a sanctioned internal tool.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Armorsteal PowerShell Install Command From SEO-Poisoned Lure Sites (locked: unlock with TL Creds)
- Armorsteal Defender Exclusions and XMRig Miner Artifacts (locked: unlock with TL Creds)
- Armorsteal Python Implant Geolocation Sandbox Check and C2 Beaconing (locked: unlock with TL Creds)
- Armorsteal Kit Files Written To SystemHealth Update Directory (locked: unlock with TL Creds)
- Armorsteal ChromElevator Browser Credential and Cookie Theft (locked: unlock with TL Creds)
- Armorsteal C2 Exfiltration and Tasking URI Patterns In Proxy Logs (locked: unlock with TL Creds)
- Armorsteal Scheduled Task Persistence ([indicator] / SysCheckX / SysHeal) and Headless conhost Launcher (locked: unlock with TL Creds)
- Armorsteal C2 Failover Domain and IP Contact From Endpoint (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 32)

Defanged, TLP:CLEAR.

- IP address: `186.2.175[.]158`
- Domain: `choclatey[.]org`
- File hash: `972fe9edb13da76113047e6db39bcc44749aaeec1be107c975649f0c413a3067`

Full set of 32 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Armorsteal Unpacked: Breaking Down a Python Malware Kit That Steals Data and Mines Crypto (Seqrite)](https://www.seqrite.com/blog/11421-2/)
- [SEO Poisoning Campaign Delivers New Armorsteal Malware (Zscaler ThreatLabz)](https://www.zscaler.com/blogs/security-research/seo-poisoning-campaign-delivers-new-armorsteal-malware)
- [Pyarmor-Static-Unpack-1shot (tool used to unpack PyArmor-protected scripts)](https://github.com/Lil-House/Pyarmor-Static-Unpack-1shot)
- [MITRE ATT&CK T1053.005 Scheduled Task](https://attack.mitre.org/techniques/T1053/005/)
- [MITRE ATT&CK T1496.001 Compute Hijacking](https://attack.mitre.org/techniques/T1496/001/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5411