Date: 10/23/2026
Severity: High
Summary
In September 2026, threat hunters identified an SEO poisoning campaign distributing Armorsteal malware through fake Chocolatey and Microsoft Activation Scripts (MAS) websites. The fraudulent pages targeted users searching for installation commands and displayed malicious PowerShell commands to download and execute the malware installer. The installer deployed a Python 3.11 runtime and three components designed for remote access, surveillance, and information theft. Armorsteal’s Python code was protected using Pyarmor to make analysis more difficult.
Indicators of Compromise (IOC) List
Domains/URLs | choclatey.org massgravel.net workerstats.net pymons.is datamons.org niceer.net supertrap.net |
IP Address | 82.153.135.80 186.2.175.183 186.2.163.185 190.115.31.69 209.99.186.187 |
Hash | f3846ec2a6ff0a27d9ef2b9bf7908743b81d295ef29344acfb96ff83fff994f9
fb1181160e9f10ce1eb5e5dc9bc23e1498a39110ee9ea361fd150454cb01b292
3e3b62a9836697d978cbb620dc8af8f6eefdf8cb73fc30d16bb394d1c58f4c97
237ba698d7dc8936c43e0e78e7644002375e51e8baf9b3a7d4e18683f871ee31
be0329d0795dd62ae587faf97e704bb36413e5c98ddd8fe575f5077db3c84e5f
04d2828155ed2a276cfd3c97d4f966d328391dd818e04e773212cd601e49fa74
56f05c4fb1c25c04e0dde60e2e5e41ac164a6dc53688d0f9eb52a55f82106389
0ea99fbbe29af6f797e3866ed5f822c7a5d3e9cdb990a8c382a715069f156499
8fb7aaf2b9270b8b75f6844aaefd5242b4f926fb89cba10fff3d9b908a769788
5410c2f239c3649928383c4478dea182f90b21f5b258081fec07e9d297ae4b1c
|
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 : | domainname like "massgravel.net" or url like "massgravel.net" or siteurl like "massgravel.net" or domainname like "workerstats.net" or url like "workerstats.net" or siteurl like "workerstats.net" or domainname like "datamons.org" or url like "datamons.org" or siteurl like "datamons.org" or domainname like "supertrap.net" or url like "supertrap.net" or siteurl like "supertrap.net" or domainname like "pymons.is" or url like "pymons.is" or siteurl like "pymons.is" or domainname like "niceer.net" or url like "niceer.net" or siteurl like "niceer.net" or domainname like "choclatey.org" or url like "choclatey.org" or siteurl like "choclatey.org" |
Detection Query 2 : | dstipaddress IN ("190.115.31.69","186.2.175.183","186.2.163.185","82.153.135.80","209.99.186.187") or srcipaddress IN ("190.115.31.69","186.2.175.183","186.2.163.185","82.153.135.80","209.99.186.187") |
Detection Query 3 : | sha256hash IN ("f3846ec2a6ff0a27d9ef2b9bf7908743b81d295ef29344acfb96ff83fff994f9","237ba698d7dc8936c43e0e78e7644002375e51e8baf9b3a7d4e18683f871ee31","56f05c4fb1c25c04e0dde60e2e5e41ac164a6dc53688d0f9eb52a55f82106389","3e3b62a9836697d978cbb620dc8af8f6eefdf8cb73fc30d16bb394d1c58f4c97","04d2828155ed2a276cfd3c97d4f966d328391dd818e04e773212cd601e49fa74","fb1181160e9f10ce1eb5e5dc9bc23e1498a39110ee9ea361fd150454cb01b292","be0329d0795dd62ae587faf97e704bb36413e5c98ddd8fe575f5077db3c84e5f","0ea99fbbe29af6f797e3866ed5f822c7a5d3e9cdb990a8c382a715069f156499","8fb7aaf2b9270b8b75f6844aaefd5242b4f926fb89cba10fff3d9b908a769788","5410c2f239c3649928383c4478dea182f90b21f5b258081fec07e9d297ae4b1c")
|
Reference:
SEO Poisoning Campaign Delivers New Armorsteal Malware