Fake Chocolatey pages install ArmorSteal malware that swaps the crypto addresses you copy

Researchers say a Python-based malware kit called ArmorSteal is spreading through fake download pages for Windows tools such as Chocolatey, targeting wallet files, recovery phrases and Discord tokens. A newer version also swaps copied crypto addresses and pauses its hidden mining whenever a user opens Task Manager.

The campaign exploits users searching for installation instructions. Its fake pages deliver the legitimate software alongside malicious components, making a successful installation part of the deception.

ArmorSteal malware hides behind legitimate software installations

Zscaler ThreatLabz reported on October 22 that the operators had created websites impersonating the Chocolatey package manager and Microsoft Activation Scripts tool.

Visitors reaching those lookalike pages through search results are instructed to paste a PowerShell command. The command installs the expected tool but also places malicious files inside a Windows directory named “SystemHealth\Update”, giving the location the appearance of a system maintenance folder.

Seqrite’s investigation identified three scheduled tasks associated with that directory: “SysCheck2”, “SysCheckX” and “SysHeal”. These tasks launch different components, including the main controller and mining manager.

The ArmorSteal malware package includes Python 3.11, removing its dependence on a pre-existing Python installation. Its scripts are protected with a trial version of PyArmor, which obscures their contents on disk. Researchers nevertheless recovered the scripts using an open-source unpacking tool.

The newer build also contains an expanded list of command servers. Seqrite identified 11 domains used by the controller, compared with four in the earlier version examined by Zscaler. That redundancy means blocking a single observed connection would leave other potential communication routes available.

Mining component stops when users inspect their computers

ArmorSteal malware checks the network environment before exposing its full behaviour. According to the research described in the report, it queries network ownership information and exits when it identifies infrastructure associated with Google, Amazon, Microsoft or Azure.

In those circumstances, it displays the error “Memory is insufficient.” The check appears intended to avoid analysis environments hosted on major cloud platforms.

The mining component uses another concealment technique: it watches for approximately 20 monitoring applications, including Task Manager, Process Explorer and Wireshark. When one opens, mining stops immediately. It resumes shortly after the application closes.

This behaviour can obscure the cause of unusually heavy resource consumption. A user investigating increased fan noise or poor performance may find that the activity has stopped by the time a monitoring window appears.

ArmorSteal malware also repeatedly adds the Windows directory to Microsoft Defender’s exclusions. The report warns that this exclusion can remain after the malicious files are removed, leaving a security setting that requires separate attention.

Researchers could not confirm the cryptocurrency or destination wallet used by the newer mining payload because its downloadable archive was no longer available. An earlier version mined Monero, so that finding should not be treated as confirmation of the newer build’s configuration.

ArmorSteal malware targets wallet access and recovery phrases

The surveillance component records keystrokes alongside window titles, allowing captured information to be associated with particular applications or websites.

It also monitors the clipboard and replaces copied cryptocurrency addresses with attacker-controlled alternatives. The reported functionality covers nine address types, including Bitcoin, Ethereum, Solana and Monero.

Additional scripts display counterfeit Exodus, MetaMask and Phantom notifications. One example reads, “You received 18.2 SOL,” apparently encouraging users to open their wallets while the keylogger is active.

Beyond this surveillance, ArmorSteal malware searches for Discord tokens, browser data and cryptocurrency wallet files. The stealer targets four Discord applications, 18 Chromium-based browsers, approximately 20 wallet extensions and 13 desktop wallets.

Stolen session tokens can enable account access without a fresh password or two-factor authentication challenge. The kit also searches drives for BIP-39 recovery phrases and collects matching files.

Password-manager vaults are another target, including those associated with KeePass, 1Password, Bitwarden, Dashlane, RoboForm and Enpass. Finding or copying a vault does not, by itself, establish that its protected contents have been decrypted.

Researchers highlight behaviour-based detection and cleanup

The report recommends looking for the operating patterns of ArmorSteal malware rather than relying solely on file hashes. Rebuilding the protected scripts changes those hashes, reducing their usefulness as the only detection method.

Relevant warning signs include Python executing from within the Windows directory, scheduled tasks launching unfamiliar scripts, changes to Defender exclusions and the appearance of mining processes.

The named scheduled tasks and the “SystemHealth\Update” directory provide additional investigation points. Defenders are also advised to review exclusions covering the entire Windows directory and address the full identified command-server infrastructure rather than a single domain.

For users, the initial exposure comes from executing instructions supplied by an impersonation site. The report advises obtaining installation guidance from verified official websites instead of trusting commands encountered through search results.

Anyone who executed a suspicious installation command should treat passwords, session tokens and wallet recovery phrases as potentially compromised. Credential recovery and account protection should be undertaken from a clean device.

The ArmorSteal malware campaign combines several ways to profit from one infected computer: stealing account access, diverting cryptocurrency transfers, collecting wallet secrets and consuming processing power. Its installation disguise and monitoring-aware behaviour make those activities harder for victims to recognise.