Search Manipulation Delivers Stealthy Credential Theft and Remote Control to Windows Systems

Cybercriminals are distributing ArmorSteal, a Python-based information stealer and remote access malware, through fraudulent software download pages designed to impersonate trusted Windows utilities. The campaign abuses search engine optimization (SEO) poisoning to direct users toward malicious installers disguised as Chocolatey and Microsoft Activation Scripts.


Zscaler Threat Hunting researchers identified the operation in September 2026 and published their findings on October 22. The malware combines credential theft, surveillance, cryptocurrency manipulation, and remote command execution, creating a significant risk for users who obtain installation instructions from unverified websites.


Search Poisoning Directs Users to Malicious Installers

The campaign uses lookalike domains to exploit searches for legitimate software installation commands.


Counterfeit Pages Preserve Expected Functionality

One domain, choclatey[.]org, impersonated the Chocolatey package manager, while massgravel[.]net posed as the Microsoft Activation Scripts project.


The malicious Chocolatey installation command deploys ArmorSteal while also running the legitimate package manager. This approach allows the expected software installation to proceed, making the compromise less noticeable to victims.


Researchers linked the distribution channels through shared malware components and an identical RSA-2048 task-signing key.


Both installers request elevated privileges, conceal their PowerShell windows, and download an archive into C:\Windows\SystemHealth\Update. The archive contains Python 3.11, Pyarmor runtime components, and protected malicious scripts.


Scheduled Tasks Maintain Persistent Access

ArmorSteal establishes persistence using two scheduled tasks with different privilege levels.


Remote Access Components Execute After Startup

The SysCheck2 task launches the remote access module when a user logs in, while SysCheckX runs it as SYSTEM following a 45-second startup delay.


The module, SysMon.py, profiles the infected computer and derives a unique identifier from its motherboard serial number. It then contacts command-and-control servers every 60 seconds to retrieve instructions.


Before executing Python tasks in memory, the malware verifies RSA-2048 signatures and checks version information to reject outdated or previously processed commands.


ArmorSteal also queries the public IP information service ipinfo.io. If the reported organization belongs to certain cloud providers, the malware displays a fabricated memory error and exits, potentially avoiding automated analysis environments.


Information Stealing Extends Across Browsers and Cryptocurrency Wallets

The malware contains separate modules for surveillance and data collection.


Keystrokes, Sessions, and Recovery Phrases Are Targeted

The basrq.py component records keystrokes, monitors active window titles, checks clipboard contents every half-second, and can replace copied cryptocurrency addresses. It also captures screenshots when specified keywords appear and displays deceptive transaction notifications resembling Exodus, MetaMask, and Phantom.


Meanwhile, got.py targets browser passwords, autofill information, payment-card metadata, SSH keys, Steam sessions, password manager data, and cryptocurrency wallet information.


Zscaler reported that the malware extracts browser cookies through Chrome DevTools Protocol on port 9222 and searches local drives for BIP39 recovery phrases. It also validates Discord authentication tokens across 22 client variants and targets 21 wallet extensions and desktop applications.