Threat feed

Armorsteal

Armorsteal: SEO-poisoned fake Chocolatey and Massgrave sites deliver Pyarmor-packed Python stealer/RAT — scheduled tasks in a C:\Windows masquerade path, Chrome DevTools-protocol cookie theft on port 9222, keyword-triggered screenshot surveillance, drive-wide BIP39 seed-phrase search

Posted · Updated · Spectrum Delta Research Team

Summary

Zscaler ThreatLabz (Nashid P, Oct 22, A/2) documents Armorsteal, a Python 3.11 malware family packed with Pyarmor 9.1.7, distributed since September 2026 through SEO poisoning: fake Chocolatey (choclatey[.]org) and Microsoft Activation Scripts/Massgrave (massgravel[.]net) websites rank for install-command searches and display a malicious PowerShell command that downloads a ZIP to C:\Windows\SystemHealth\Update\ (a Python 3.11 runtime plus three modules) and creates scheduled tasks. The remote-access module polls a hardcoded set of C2 domains every 60 seconds using a machine ID derived from the motherboard serial number, fetching RSA-2048-signed Python tasks executed in memory, with per-victim (/get-onetime-code/) and global (/get-global/) task channels versioned via onetime_version.txt and global_version.txt. The surveillance module hijacks the clipboard every 0.5 seconds replacing copied cryptocurrency addresses (BTC, LTC, XMR, ETH, TRON, XRP, DOGE, TON, SOL), captures screenshots when configured keywords appear, uploads XOR-encrypted PNGs and keystroke logs, and shows fake Exodus/MetaMask/Phantom transaction notifications. The stealer extracts browser cookies via the Chrome DevTools Protocol on port 9222, searches drives A: through Z: for BIP39 seed phrases, and harvests wallets (21 extensions/apps), Discord tokens (22 client variants), password managers, SSH keys and Steam sessions. Zscaler links both lure sites to one operation via shared components and the RSA task-signing key; after the lure sites went down (~Sept 25 and ~Oct 1) the operation kept rotating C2 (workerstats[.]net to pymons[.]is/datamons[.]org in early October) and moved module downloads to token-protected /C2/?t= requests with an X-Verify header — the actor is assessed to remain active.

Breakdown

Adversary

Unknown eCrime operator

Procedures (3)

  1. SEO-lure PowerShell chain builds SystemHealth persistence

    SEO-poisoned install chain: fake Chocolatey/MAS lure to scheduled-task persistence in a Windows masquerade path

    Logs

    • Windows event logs · PowerShell script-block; schtasks create; file create in SystemHealth path

    Detectors

    • Zscaler cloud sandbox · PS.Dropper.Armorsteal / Python.PWS.Armorsteal on installer and payload
    • Zscaler MDR · WIN-SCHTASKS-CREATE-SHELL on scheduled-task creation
    • Zscaler MDR · WIN-CONHOST-HEADLESS-CMD on hidden-console install
Click to expand remaining (2) procedures

  1. Machine-keyed C2 polls signed Python tasks every 60s

    Machine-keyed C2: 60-second polling of signed in-memory Python tasks with versioned channels

    • T1071.001Application Layer Protocol: Web Protocols

    Logs

    • Zscaler Web Insights (inspected) · Full URL paths to C2: /receive_infof, /get-global, /black-watch/, /infame/

    Detectors

    No known detector

  2. CDP cookie theft and keyword-triggered surveillance

    Surveillance and harvesting: CDP cookie theft, clipboard address swap, keyword-triggered screenshots, BIP39 drive search

    • T1539Steal Web Session Cookie

    Logs

    • Zscaler Web Insights (inspected) · Full URL paths to C2: /receive_infof, /get-global, /black-watch/, /infame/
    • EDR process telemetry · Browser cmdline with remote-debugging-port=9222; Python clipboard polling

    Detectors

    • Zscaler MDR · WIN-PYTHON-CHROMIUM-HEADLESS on Python driving headless Chromium

Indicators of compromise

Hunt only

C2 domains: workerstats[.]net (primary, unavailable since early Oct), pymons[.]is, datamons[.]org (standby then active), supertrap[.]net, niceer[.]net (standby). Lure domains (down: massgravel[.]net ~Sept 25, choclatey[.]org ~Oct 1): choclatey[.]org, community[.]choclatey[.]org, massgravel[.]net. IPs: 104.21.87[.]146 (Cloudflare, workerstats), 209.99.186[.]187 (SKN Subnet & Telecom, payload host), 82.153.135[.]80 (AKILE LTD UK, payload host), 186.2.175[.]183 (IQWeb FZ-LLC, C2), 186.2.163[.]185, 190.115.31[.]69. SHA256: install.ps1 f3846ec2a6ff0a27d9ef2b9bf7908743b81d295ef29344acfb96ff83fff994f9 (MAS lure) and fb1181160e9f10ce1eb5e5dc9bc23e1498a39110ee9ea361fd150454cb01b292 (Chocolatey lure); Update.zip 3e3b62a9836697d978cbb620dc8af8f6eefdf8cb73fc30d16bb394d1c58f4c97; nig20084.zip 237ba698d7dc8936c43e0e78e7644002375e51e8baf9b3a7d4e18683f871ee31; getthem20084.zip be0329d0795dd62ae587faf97e704bb36413e5c98ddd8fe575f5077db3c84e5f; SysMon.py 0ea99fbbe29af6f797e3866ed5f822c7a5d3e9cdb990a8c382a715069f156499; basrq.py 8fb7aaf2b9270b8b75f6844aaefd5242b4f926fb89cba10fff3d9b908a769788; got.py 5410c2f239c3649928383c4478dea182f90b21f5b258081fec07e9d297ae4b1c. Assessed 2026-10-27; lure infrastructure is perishable (already rotated once), C2 domains move — hunt keys are the URL paths and scheduled-task names below.

Durable

Scheduled tasks SysCheck2 (logon) and SysCheckX (boot, +45s delay); directory C:\Windows\SystemHealth\Update\ with onetime_version.txt and global_version.txt; module filenames SysMon.py, basrq.py, got.py; C2 URL paths /receive_infof, /get-onetime-code/{machine_id}, /get-global, /downloadables/, /black-watch/{machine_id}, /black-watch/screenshot/{machine_id}, /infame/receive/zip, /infame/receive/dt, /ws/{machine_id}, /pwd, /upload/st; token-protected module fetches /C2/?t=[token]451 (surveillance) and /C2/?t=[token]452 (stealer) with X-Verify header, archives at /p/[32hex].zip; browser command line --remote-debugging-port=9222; 60-second task poll and 300-second keyword refresh cadence; RSA-2048 (RSASSA-PKCS1-v1_5) signed in-memory Python task execution; XOR key for screenshot upload = SHA256 of hardcoded string c1146fbcaa433385839c25839a61cd7fedaff858cc0d3fd063dba68db2cf31b4; clipboard address swap across BTC/LTC/XMR/ETH/TRON/XRP/DOGE/TON/SOL

Sources

Grades are source reliability (A–F) and information credibility (1–6).

Questions, detections or sightings of Armorsteal? Bring them to the community.

Discuss in the Tradecraft Slack