ArmorSteal malware distributed via fake Chocolatey and Microsoft sites

Cybercriminals are using search engine poisoning to distribute ArmorSteal, a Python-based malware family, through fraudulent websites impersonating Chocolatey and Microsoft Activation-Script. The campaign utilizes typosquatted domains, such as ‘choclatey[. ]org’, to present malicious PowerShell commands that install the malware while simultaneously running the legitimate software to avoid detection.

ArmorSteal is designed for remote access, surveillance, and information theft. It targets sensitive data including passwords, browser cookies, authentication tokens, and cryptocurrency wallet information. The malware achieves persistence on infected systems through scheduled tasks named ‘SysCheck2’ and ‘SysCheckX’, which execute remote access modules with elevated privileges.

Security researchers at Zscaler identified the campaign, noting that the two distribution channels are linked by shared malware components and an identical RSA-2048 task-signing key. The malicious packages are downloaded to the ‘C:\Windows\SystemHealth\Update’ directory and utilize Pyarmor to protect the scripts.