Executive Summary
In September 2026, threat hunters identified an SEO poisoning campaign distributing a new Python-based malware family called Armorsteal. The campaign targeted users searching for the Chocolatey package manager and Microsoft Activation Scripts (MAS) by serving malicious PowerShell commands through typosquatted domains like choclatey[.]org and massgravel[.]net. The infection process installs a modular payload designed for persistent remote access, surveillance, and comprehensive information theft.
Technically, Armorsteal is noteworthy for its use of Pyarmor for code obfuscation and a modular architecture comprising three distinct components: a remote access module (SysMon.py), a surveillance module (basrq.py), and a stealer module (got.py). The malware employs anti-analysis checks against cloud environments and utilizes RSA-2048 signatures to verify remote tasks before execution. The surveillance and stealer components specifically target cryptocurrency wallets, Discord tokens, browser credentials, and SSH keys.
This campaign represents a significant risk to developers and IT administrators who frequently use command-line installation tools. The infrastructure has shown agility, moving through multiple hosting providers and C2 domains, and evolving its delivery methods to include token-based authentication for module downloads, highlighting a persistent and adaptive threat.