Armorsteal: Googling 'Install Chocolatey' Shouldn't Cost You Your Passwords

Usual disclosure: I work at Zscaler, and this one comes from our Threat Hunting team. I'm a few days late on it. It's not the flashiest research of the month, but it targets a habit almost every IT person and developer has: search for the install command, copy it, paste it into an admin PowerShell window, hit Enter.

The Lure

Zscaler Threat Hunting found an SEO poisoning campaign, active in September 2026, pushing a new Python-based malware family they track as Armorsteal. Two fake sites did the work:

• choclatey[.]org, a typosquat of the Chocolatey package manager. Search "install Chocolatey" or "Chocolatey PowerShell," land here.
• massgravel[.]net, impersonating Microsoft Activation Scripts (MAS), aka Massgrave. Search "MAS activation script," land here.

Both showed a PowerShell one-liner. The Chocolatey lure even ran the real Chocolatey installer, so everything looked like it worked. That's the detail I like least. There's no error to make you suspicious.

Both sites went down in late September and early October. The technique didn't.

What Armorsteal Does

The installer asks for admin rights, hides the console, and drops a bundled Python 3.11 runtime plus encrypted scripts into C:\Windows\SystemHealth\Update\. Then it sets up two scheduled tasks, SysCheck2 at logon and SysCheckX at boot as SYSTEM.

From there it's three modules:

• Remote access: profiles the host, checks in with C2 every 60 seconds, and only runs tasks signed with the operator's RSA key. Somebody cared about not getting their botnet hijacked.
• Surveillance: keylogging, window titles, clipboard monitoring every half second, swapping copied crypto wallet addresses, and keyword-triggered screenshots.
• Stealer: browser cookies (via Chrome's remote debugging port 9222), saved passwords, Discord tokens, crypto wallets and seed phrases, password managers like KeePass, 1Password, and Bitwarden, SSH keys, and Steam data.

It also checks whether it's running in a cloud provider's IP space. If it is, it shows a fake "Memory is insufficient" error and quits. That's a sandbox dodge, and a reminder that a lot of analysis environments run in the cloud.

Why This Works

Two reasons. First, "run this PowerShell command" is now a completely normal way to install software, so the lure doesn't look like a lure. Second, the people searching for Chocolatey install commands are often admins and developers, the people with the SSH keys, password vaults, and elevated rights worth stealing.

The Massgrave lure is its own lesson. People looking for activation scripts are already in "run something from the internet I can't verify" mode. Attackers love that mode.

What To Do

• Hunt: look for SysCheck2 and SysCheckX scheduled tasks and anything under C:\Windows\SystemHealth\Update\.
• Check PowerShell logs for downloads from the lure domains, and block the lure and C2 domains listed in the research.
• Look for browsers started with remote debugging on port 9222. Normal users don't do that.
• Remove unauthorized Defender exclusions, especially anything covering C:\Windows.
• Give admins a known-good source for install commands, an internal package repo or a documented link, so nobody needs to search for them.
• Inspect and sandbox downloads. Zscaler says its Cloud Sandbox detects Armorsteal as PS.Dropper.Armorsteal and Python.PWS.Armorsteal, and lists MDR detections for the headless console, scheduled task, and headless Chromium behavior.

Bottom Line

The most dangerous command on your network might be one someone found on page one of a search result. Bookmark your install sources, verify the domain before you paste, and treat any one-liner that asks for admin rights the way you'd treat a stranger asking for your badge.

Full research: SEO Poisoning Campaign Delivers New Armorsteal Malware (Zscaler)