EN PT-BR
← Voltar ao feed
high

ArmorSteal Python infostealer/RAT spread via fake Chocolatey and Microsoft Activation Scripts sites using SEO poisoning

1 fonte(s) · 1 atualização(ões) · publicado 24/10/2026 06:10 · coletado há 1 semana

Zscaler's Threat Hunting team identified a campaign in September 2026, published on October 22, that distributes ArmorSteal, a Python-based malware family combining remote access, surveillance and information theft. Victims are lured by search engine poisoning to typosquatted sites impersonating Chocolatey (choclatey[.]org) and the Microsoft Activation Scripts project (massgravel[.]net), which display malicious PowerShell install commands. Shared components and an identical RSA-2048 task-signing key link both channels to one operation. ArmorSteal steals passwords, cookies, tokens and cryptocurrency wallet data. Both lure sites have gone offline, but operators moved infrastructure to pymons[.]is and datamons[.]org.

Detalhes técnicos

  • The Chocolatey lure runs ArmorSteal alongside the legitimate Chocolatey installer, so the package manager works normally and hides the compromise.
  • Installers request elevated privileges, hide the PowerShell console and download an archive to C:\Windows\SystemHealth\Update containing Python 3.11, Pyarmor runtime files and scripts protected with Pyarmor 9.1.7.
  • Persistence uses two scheduled tasks: SysCheck2 (runs the RAT at logon with highest privileges) and SysCheckX (runs as SYSTEM after a 45-second startup delay).
  • SysMon.py is the remote access module. It profiles the host, derives a machine ID from the motherboard serial number and polls C2 every 60 seconds for victim-specific and campaign-wide Python tasks. It verifies RSA-2048 signatures and version numbers before running tasks in memory, preventing replay of old instructions.
  • Anti-analysis: it queries ipinfo[.]io and, if the organization field matches selected cloud providers, shows a fake memory error and exits.
  • basrq.py logs keystrokes and window titles, checks the clipboard every 0.5 seconds and swaps cryptocurrency addresses. It takes keyword-triggered screenshots and shows fake Exodus, MetaMask and Phantom transaction notifications.
  • got.py steals browser passwords, autofill data, credit card metadata, SSH keys, Steam sessions and password manager data. It validates tokens from 22 Discord client variants and targets 21 wallet extensions and desktop apps. Cookies are extracted via Chrome DevTools Protocol on port 9222, and other routines search drives for BIP39 recovery phrases.

Remediação

  • Investigate the SysCheck2 and SysCheckX scheduled tasks and inspect the C:\Windows\SystemHealth directory.
  • Review PowerShell download activity and monitor browser remote-debugging activity.
  • Remove unauthorized Microsoft Defender exclusions.

Linha do tempo

  1. gbhackers.com ↗ · pub. 24/10/2026 06:10 · coletado 24/10 07:00 primeiro registro

    ArmorSteal Python infostealer/RAT spread via fake Chocolatey and Microsoft Activation Scripts sites using SEO poisoning

    ler a análise desta fonte

    Zscaler's Threat Hunting team identified a campaign in September 2026, published on October 22, that distributes ArmorSteal, a Python-based malware family combining remote access, surveillance and information theft. Victims are lured by search engine poisoning to typosquatted sites impersonating Chocolatey (choclatey[.]org) and the Microsoft Activation Scripts project (massgravel[.]net), which display malicious PowerShell install commands. Shared components and an identical RSA-2048 task-signing key link both channels to one operation. ArmorSteal steals passwords, cookies, tokens and cryptocurrency wallet data. Both lure sites have gone offline, but operators moved infrastructure to pymons[.]is and datamons[.]org.

    Technical Details

    • The Chocolatey lure runs ArmorSteal alongside the legitimate Chocolatey installer, so the package manager works normally and hides the compromise.
    • Installers request elevated privileges, hide the PowerShell console and download an archive to C:\Windows\SystemHealth\Update containing Python 3.11, Pyarmor runtime files and scripts protected with Pyarmor 9.1.7.
    • Persistence uses two scheduled tasks: SysCheck2 (runs the RAT at logon with highest privileges) and SysCheckX (runs as SYSTEM after a 45-second startup delay).
    • SysMon.py is the remote access module. It profiles the host, derives a machine ID from the motherboard serial number and polls C2 every 60 seconds for victim-specific and campaign-wide Python tasks. It verifies RSA-2048 signatures and version numbers before running tasks in memory, preventing replay of old instructions.
    • Anti-analysis: it queries ipinfo[.]io and, if the organization field matches selected cloud providers, shows a fake memory error and exits.
    • basrq.py logs keystrokes and window titles, checks the clipboard every 0.5 seconds and swaps cryptocurrency addresses. It takes keyword-triggered screenshots and shows fake Exodus, MetaMask and Phantom transaction notifications.
    • got.py steals browser passwords, autofill data, credit card metadata, SSH keys, Steam sessions and password manager data. It validates tokens from 22 Discord client variants and targets 21 wallet extensions and desktop apps. Cookies are extracted via Chrome DevTools Protocol on port 9222, and other routines search drives for BIP39 recovery phrases.

    Remediation

    • Investigate the SysCheck2 and SysCheckX scheduled tasks and inspect the C:\Windows\SystemHealth directory.
    • Review PowerShell download activity and monitor browser remote-debugging activity.
    • Remove unauthorized Microsoft Defender exclusions.