ArmorSteal Malware Steals Passwords and Crypto Wallet Data, Hides Mining When Task Manager Opens

What happened

The miner shuts down whenever a user opens Task Manager or another monitoring tool. The kit ships with its own Python 3.11 runtime.

Three scheduled tasks keep it alive: SysCheck2, SysCheckX and the newly observed SysHeal. It steals credentials and crypto wallets, hijacks clipboard addresses, and runs a hidden Monero-style miner.

Zscaler ThreatLabz documented the family on 22 October 2026.

cyber security Cyber Security News Malware 3 min.

The Seqrite sample is newer than that report and an earlier June 2026 build. Victims searching for Chocolatey or the Microsoft Activation Scripts land on typosquatted pages.

These pages display a PowerShell command that installs the real tool and quietly drops the kit into C:\Windows\SystemHealth\Update. Every script is protected with the trial version of PyArmor 9.1.7.