ArmorSteal Malware: Fake Chocolatey and Activation Tool Sites Steal Passwords and Crypto, and How to Check Your Windows PCs
ArmorSteal is Windows malware spread through fake Chocolatey and Microsoft Activation Scripts pages. It steals passwords, browser sessions and crypto wallets, and its miner stops when Task Manager opens.
Where Worldwide
On this page 9 sections
ArmorSteal is newly documented Windows malware that steals saved passwords, browser sessions and crypto wallets, and it spreads through fake download pages for common IT tools. It matters to businesses because those lures target people installing admin software, and one infected PC can give up the password vaults and SSH keys that reach company systems.
Two research teams have published on it: Zscaler ThreatLabz on October 22, 2026, and Seqrite Labs on November 6, 2026. Neither says how many PCs are infected, so treat this as a specific threat worth checking for, not proof of a mass outbreak.
What is ArmorSteal malware?
ArmorSteal is a malware kit for Windows written in Python. It brings its own copy of Python 3.11, so the PC does not need Python installed, and its code is scrambled with a tool called Pyarmor. It has separate parts for remote control, spying on the user and stealing files.
Before running, it asks ipinfo.io who owns the network it is on, and quits with a fake "Memory is insufficient" error if the answer is Google, Amazon, Microsoft or Azure. Zscaler says this can stop it from running in some cloud-based analysis systems.
How does ArmorSteal get onto a PC?
Zscaler says it identified the campaign in September 2026. People searching for how to install Chocolatey, a Windows package manager, or Microsoft Activation Scripts, an open-source Windows and Office activator, landed on look-alike sites including choclatey[.]org (note the missing "o") and massgravel[.]net. Each page displayed a PowerShell command to paste and run. The Chocolatey lure also ran the real installer, so everything appeared to work.
Neither report says the real projects were breached. Zscaler says the fake Massgrave site went down on September 25 and the fake Chocolatey site around October 1, which does nothing for a PC already infected. Seqrite did not see this first step on the machine it studied.
The kit installs to C:\Windows\SystemHealth\Update\, a path chosen to look like part of Windows, and uses scheduled tasks named SysCheck2 and SysCheckX to keep running. Seqrite also found a third task, SysHeal.
What does ArmorSteal steal?
- Browser data: saved passwords, cookies, autofill entries and saved card details
- Password managers: data from KeePass, 1Password, Bitwarden, Dashlane, RoboForm, Password Safe and Enpass
- Crypto: about 20 browser wallet extensions, desktop wallets, and seed phrases found by scanning drives
- Access keys: SSH keys and Discord tokens
- Live activity: keystrokes, plus screenshots triggered by keywords
- Clipboard: copied wallet addresses for nine cryptocurrencies are swapped for the attacker's, so a payment goes to the wrong place
Password manager files are normally encrypted, but this kit also records keystrokes, so we would treat any master password typed on an infected PC as exposed.
Does ArmorSteal hide from Task Manager?
Partly, and the detail matters. Seqrite found a bundled XMRig cryptocurrency miner run by a script that checks once a second for 20 monitoring tools, including Task Manager, Resource Monitor, Process Explorer and Wireshark. If one is open, the miner is killed at once and comes back after the tool closes. If a tool stays open for more than an hour, the script kills the tool instead.
Only the miner is described as doing this. The theft and spying parts are not, so a calm Task Manager proves nothing. The kit also adds C:\Windows and xmrig.exe to Microsoft Defender's exclusions, and re-adds them every 60 seconds if they are removed.
ArmorSteal: what is confirmed and what is not
| Claim | Status |
|---|---|
| Fake Chocolatey and MAS sites delivered it | Reported by Zscaler. Seqrite did not observe this step |
| It steals passwords, cookies, wallets, vault data and SSH keys | Documented by both teams |
| Hidden miner that stops for Task Manager | Seqrite only, from one infected machine. Zscaler does not mention mining |
| The miner mines Monero | Not confirmed. Seqrite calls Monero "the most likely coin" because an older build mined it |
| Number of victims, industries, countries | Not stated by either report |
| Who runs it | Not named by either report |
How to check for ArmorSteal on Windows
Open PowerShell as administrator on any PC you have doubts about, and run:
Get-ScheduledTask -TaskName SysCheck2,SysCheckX,SysHeal -ErrorAction SilentlyContinue
Test-Path "C:\Windows\SystemHealth\Update"
(Get-MpPreference).ExclusionPath
(Get-MpPreference).ExclusionProcess
Any task returned, True from the folder check, or C:\Windows or xmrig.exe in the exclusions means investigate. A clean result only rules out the builds described so far.
What to do this week
| Action | Details |
|---|---|
| Search your logs | Review PowerShell, DNS and proxy logs for choclatey[.]org, massgravel[.]net, workerstats[.]net, pymons[.]is and datamons[.]org |
| Block domains | Block those domains and the full lists in both reports. The lists differ by build |
| Add alerts | Python running from under C:\Windows, browsers started with --remote-debugging-port=9222, new Defender exclusions |
| Limit installs | Our advice: remove local admin rights from daily accounts and publish approved download sources for tools |
| Check crypto payments | Compare the full wallet address before any transfer |
Seqrite warns that file hashes alone are a weak way to detect this kit, so lean on behavior alerts.
If you find it
Disconnect the PC from the network and, as our recommendation, rebuild it rather than deleting files. Seqrite notes the Defender exclusion stays behind after cleanup. From a clean device, change every password stored or typed on that PC, sign out all active sessions, replace SSH keys, and move crypto to a wallet with a new seed phrase.
Why ArmorSteal matters for a company network
Passwords are only part of it. A stolen session cookie can let someone skip the login entirely, which is the problem device bound session credentials are built to reduce, and it is worth knowing how far MFA goes against stolen passwords. SSH keys can reach servers directly. One technician's laptop may hold more access than any other machine in the building.
If someone on staff is searching for a Windows activator, that is also a licensing conversation, not only a security one.
ArmorSteal questions people are asking
Is there a patch for ArmorSteal?
No. Neither report describes a software flaw. It relies on a person running a command, so the answer is checking PCs and controlling installs.
Can Windows Defender detect ArmorSteal?
Do not rely on it alone. Seqrite reports that the kit excludes the whole Windows folder from Defender scanning, and that is where it lives.
Is Chocolatey safe to use?
Neither report says Chocolatey itself was compromised. Use chocolatey.org, and confirm any install command points to community.chocolatey.org.
Does ArmorSteal mine Monero?
That is unconfirmed. The miner package was gone when Seqrite looked, so the coin and wallet could not be seen.
Who is behind ArmorSteal?
Neither report names a person or group.
The bigger lesson
A search result is not a trusted source, and a command copied from a web page runs with whatever rights you have. Give your team one approved place to get tools, and watch for behavior, because the easiest check, opening Task Manager, is one this malware was built to beat.
Want your Windows fleet locked down? See our security hardening work or request a quote.
Get security alerts by email, with the free checklist, at security alerts.
Sources: Zscaler ThreatLabz; Seqrite Labs; Chocolatey install page; Microsoft Activation Scripts; Microsoft Get-ScheduledTask; Microsoft Get-MpPreference.
Have a question about this article?
Ask it here and we will answer you directly by email. Questions are private, never posted.
Security alerts by email
Hear about the next one first.
When attackers start using a flaw in software businesses run on, we email what it is, whether it touches you and what to do that week, with a round-up of our latest security writing. Free, one-click unsubscribe. You get the checklist straight away: 12 things to secure this week.
Want a result like this?
Security alerts, breaches and the technology a business runs on: what happened, who it affects and what to do.
Get a Tech QuoteKeep reading
Jensen Huang Investigation: NVIDIA's Board Opens a Probe Into a Reported Foreign Intelligence Effort, What Is Confirmed and How to Protect Your Executives
NVIDIA's board has opened an independent investigation after reports that CEO Jensen Huang was a foreign intel...
Abe Office Malware: Signed Fake Helper Carries Code to Make Chrome Decrypt Its Own Cookies, What Is Confirmed and What to Check
A signed Windows trojan posing as an Abe Office helper carries code to make Chrome unlock its own protected co...
WorkOS Breach: An AI Agent That Escaped a Researcher's Test Environment Sat in a Sales Tool for Five Days, What Is Confirmed and What to Check
WorkOS says an AI agent that escaped a researcher's test environment accessed an internal sales tool for five...
