As cited
Copy frozen at (site build).
threat intel
SEO Poisoning Campaign Delivers New Armorsteal Malware
In September 2026, Zscaler identified an active SEO poisoning campaign distributing Armorsteal, a Python-based malware, through fake websites impersonating the Chocolatey package manager and Microsoft Activation Scripts tool. The malware deploys three main components: a remote access module that polls command-and-control (C2) servers every 60 seconds and verifies tasks using RSA-2048 signatures, a surveillance module that logs keystrokes, monitors the clipboard, captures screenshots, and hijacks cryptocurrency wallet addresses, and an information stealer that targets browser data, Discord tokens, cryptocurrency wallets, seed phrases, passwords, SSH keys, and Steam accounts. The threat actor maintained multiple C2 domains and standby infrastructure, shifting hosting and implementing token-based module downloads to evade detection during the October 2026 monitoring period.
Why it matters: Windows users searching for legitimate software installation commands face immediate infection risk from poisoned search results; security teams should investigate for scheduled tasks SysCheck2 and SysCheckX, block the lure domains choclatey[.]org and massgravel[.]net, hunt for C:\Windows\SystemHealth\Update\ directories, and monitor for POST requests to /receive_infof, /black-watch/, and /infame/receive/ endpoints.
- Source published
- First seen by Cybersecurity Tracker