SEO Poisoning Campaign Uses Fake Sites to Spread Armorsteal

In September 2026, Zscaler Threat Hunting uncovered an SEO poisoning campaign delivering Armorsteal malware via two typosquatted sites impersonating Chocolatey and Massgrave, which appeared at the top of search results for installation commands. Victims were directed to open an admin PowerShell prompt and paste a one-line command.

The Chocolatey lure even ran the real Chocolatey installer to look legitimate, while the Massgrave site went offline on 25 September 2026 and the Chocolatey domain followed around 1 October 2026. When executed, the script elevates privileges, hides the console, and downloads a ZIP archive into a fake SystemHealth update folder inside the Windows directory. Inside is a standalone Python 3.11 runtime and three obfuscated Armorsteal modules protected with a Pyarmor trial (9.1.7).

The campaign uses a single threat actor, according to Zscaler, with shared malware components, a task-signing key, and common C2 infrastructure tying both lures together. The operator targets include 22 Discord client variants, 21 cryptocurrency wallets, and seven password managers, suggesting a clear financial motive.

The infection chain continues with two scheduled tasks, SysCheck2 and SysCheckX, to sustain persistence and run at logon or after boot. The malware performs IP lookups and suppresses execution if it detects Google, Amazon, Microsoft, or Azure addresses, aiming to evade cloud sandboxes. Its C2 setup features a unique machine ID derived from the motherboard serial, four hardcoded HTTPS command servers, and RSA-2048 signature verification before in-memory code execution.

Secondary ZIP packages deliver surveillance and stealer capabilities: keystroke logging across multiple languages, clipboard monitoring for wallet addresses, screenshots triggered by crypto or cloud keywords, and encrypted uploads. The information stealer searches drives for BIP39 phrases, steals SSH keys and browser data, and exfiltrates a compressed archive. Detection guidance includes hunting for SysCheck2/SysCheckX tasks, reviewing for 9222 port activity, and verifying domains before running commands.