Somebody searching Google for "chocolatey install windows" in September could have landed on choclatey[.]org, one letter short of the real thing, and been handed a PowerShell command that looked exactly like the official installer. Running it did install Chocolatey. It also quietly installed a new malware family that Zscaler's Threat Hunting team tracks as Armorsteal.
That is the trick at the heart of a search-poisoning campaign documented by Zscaler ThreatLabz. The people it targets are exactly the ones used to pasting commands into an elevated terminal: developers and administrators setting up the Chocolatey package manager, and users looking for the Microsoft Activation Scripts (MAS) tool, also known as the Massgrave project, which a second lookalike site, massgravel[.]net, impersonated.
One copy-paste command, three malicious modules
Both installers ask for elevated privileges, hide the PowerShell window and drop a ZIP archive into C:\Windows\SystemHealth\Update\, a path chosen to pass for a genuine Windows folder. Inside is a bundled Python 3.11 runtime and Armorsteal's scripts, obfuscated with a trial copy of the Pyarmor protector, which Zscaler notes gives the operator code encryption without paying for a commercial licence.
Persistence comes from two scheduled tasks: SysCheck2, which fires at user logon with the highest available privileges, and SysCheckX, which runs at boot as SYSTEM after a 45-second delay. Before doing anything else, the malware checks its public IP with ipinfo[.]io, and if the address belongs to Google, Amazon or Microsoft it shows a fake "Memory is insufficient" error and exits, a simple way to dodge cloud-hosted analysis sandboxes.
From there Armorsteal splits into three parts:
- Remote access (SysMon.py) profiles the machine, polls its command server every 60 seconds and runs Python tasks in memory, but only after verifying each one against an embedded RSA-2048 public key. That signature check means a researcher or rival who seizes a command domain cannot simply push their own code to the infected fleet.
- Surveillance (basrq.py) logs keystrokes alongside the active window title, checks the clipboard every half second and swaps copied wallet addresses for the attacker's own across Bitcoin, Ethereum, Monero, Solana, TON, XRP and other chains. It takes screenshots when operator-supplied keywords appear and can pop up fake transaction notices impersonating Exodus, MetaMask and Phantom.
- Stealer (got.py) takes Discord tokens from 22 client variants, data from 21 wallet extensions and apps, saved browser passwords, cookies, autofill and card metadata, SSH keys and Steam sessions. It searches every drive from A: to Z: for BIP39 seed phrases and targets password manager data from KeePass, 1Password, Bitwarden, Dashlane and others. For Chrome passwords it downloads a public App-Bound Encryption decryption tool, and it pulls cookies through the browser's remote debugging port, 9222.
An operator that keeps moving house
Zscaler watched the infrastructure shift several times. The primary command domain, workerstats[.]net, was registered in January 2026, while the two lure domains were registered on August 30 and September 1. In mid-September the operator moved the lure sites to a UK host and pulled the command server out from behind Cloudflare onto DDoS-Guard name servers. By early October workerstats[.]net was gone and pymons[.]is plus the previously dormant datamons[.]org had taken over, and the add-on modules now only download with a valid token. The fake Massgrave site went offline on September 25 and the Chocolatey clone around October 1, but Zscaler says the core malware stayed unchanged throughout.
The lure itself is familiar. Fake installers pushed through search results have carried everything from remote access trojans hidden in KakaoTalk downloads to cracked software laced with stealers. What stands out here is the choice of bait: tools whose official instructions already tell you to paste a remote script into an admin shell.
Hunt for SysCheck2, SysCheckX and the SystemHealth folder
Zscaler recommends that defenders:
- Look for the SysCheck2 and SysCheckX scheduled tasks and anything under C:\Windows\SystemHealth\Update\.
- Review PowerShell logs for downloads from choclatey[.]org, community[.]choclatey[.]org and massgravel[.]net, and block the domains below.
- Check outbound HTTPS, where paths are visible, for /receive_infof, /get-global, /black-watch/ and /infame/receive/.
- Flag browser processes started with --remote-debugging-port=9222.
- Remove unauthorised Microsoft Defender exclusions, especially any covering C:\Windows.
Anyone who ran one of these commands should treat every password, browser session, SSH key and wallet on that machine as compromised, and move funds from a clean device. The wider lesson is simple to say and hard to practise: an install command is code, and it deserves the same scrutiny as the domain it came from.
Indicators of compromise
- Lure domains: choclatey[.]org, massgravel[.]net
- C2 domains: workerstats[.]net, pymons[.]is, datamons[.]org, niceer[.]net, supertrap[.]net
- IPs: 82[.]153[.]135[.]80 and 209[.]99[.]186[.]187 (payload hosts), 186[.]2[.]175[.]183, 186[.]2[.]163[.]185, 190[.]115[.]31[.]69 (C2)
- install.ps1 (Chocolatey lure), SHA256: fb1181160e9f10ce1eb5e5dc9bc23e1498a39110ee9ea361fd150454cb01b292
- install.ps1 (MAS lure), SHA256: f3846ec2a6ff0a27d9ef2b9bf7908743b81d295ef29344acfb96ff83fff994f9
- SysMon.py, SHA256: 0ea99fbbe29af6f797e3866ed5f822c7a5d3e9cdb990a8c382a715069f156499
- basrq.py, SHA256: 8fb7aaf2b9270b8b75f6844aaefd5242b4f926fb89cba10fff3d9b908a769788
- got.py, SHA256: 5410c2f239c3649928383c4478dea182f90b21f5b258081fec07e9d297ae4b1c
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.