WORLDTECHFake Chocolatey and Microsoft Activation Sites Push ArmorSteal Malware
Attackers are pushing ArmorSteal, a Python-based malware family, through lookalike websites that pose as Chocolatey and the Microsoft Activation Scripts project. According to a GBHackers report, the campaign targets people who search for installation commands.
Two lookalike domains, one operation
The typosquatted domain choclatey[.]org imitated Chocolatey and displayed a malicious PowerShell installation command. A second domain, massgravel[.]net, impersonated the Microsoft Activation Scripts project.
Common malware components and an RSA-2048 task-signing key that is identical on both sites tie the two distribution channels to one operation. Both installers ask for elevated privileges, hide the PowerShell console, and drop an archive into C:\Windows\SystemHealth\Update.
Real installer runs alongside the payload
Running the fake installer deployed ArmorSteal while also launching the genuine Chocolatey installer. The package manager kept working as expected, which made visible signs of compromise less likely.
The package carries Python 3.11, Pyarmor runtime files, and malicious scripts protected with Pyarmor 9.1.7. SysCheckX runs it as SYSTEM after a 45-second delay following startup, while SysCheck2 starts the remote access module at user logon with the highest available privileges.
Remote access and surveillance modules
The remote access module, SysMon.py, profiles infected machines and derives a machine identifier from the motherboard serial number. Every 60 seconds it polls command-and-control servers for victim-specific and campaign-wide Python tasks. Before running a task in memory, it checks RSA-2048 signatures and compares version numbers with locally stored values, so older or already processed instructions do not run again.
The surveillance module basrq.py logs keystrokes and window titles, checks the clipboard every half-second, and swaps cryptocurrency addresses. It also takes screenshots when keywords are typed and shows fake Exodus, MetaMask, and Phantom transaction notifications.
Checks that could sidestep cloud analysis
ArmorSteal looks up public IP ownership through ipinfo[.]io. If selected cloud providers appear in the organization field, it shows a fake memory error and exits, which could help it avoid cloud-hosted analysis environments.