- Zscaler Threat Hunting found a September 2026 campaign where fake Chocolatey and Microsoft Activation Scripts sites, reached through search, gave users a PowerShell command that installed Armorsteal malware.
- On the fake Chocolatey site, the script also ran the real installer, so Chocolatey appeared to work as expected. Zscaler says the operator kept changing hosting.
- Leaders should ask whether staff can run commands copied from search results, and whether endpoint tools flag new scheduled tasks and unexpected Python runtimes.
Zscaler Threat Hunting found a September 2026 campaign in which fake Chocolatey and Massgrave websites, reached through search, handed visitors a PowerShell command that installed a data stealer. Zscaler ThreatLabz published the findings on October 22. This is WebPulse's view: in this campaign a search result acted as a software supplier, and few controls treat it like one.
What Zscaler found
Zscaler's threat hunters traced a search-poisoning campaign that ran in September 2026. Search poisoning, or SEO poisoning, means gaming search engines so a fake site shows up for people looking for the real thing.
The fake sites copied two Windows tools. One was the Chocolatey package manager, copied at the misspelled domain choclatey[.]org. The other was the Microsoft Activation Scripts tool, also called Massgrave, copied at massgravel[.]net.
Each page showed a PowerShell command for the visitor to run. That command installed a Python-based malware family Zscaler tracks as Armorsteal. Zscaler says the fake Massgrave site went down on September 25. The fake Chocolatey site followed around October 1.
The report does not say how many people were infected.
A lure that still delivers the real tool
On the fake Chocolatey site, the script did two jobs. It installed the malware. It also ran the genuine Chocolatey installer, so Zscaler says Chocolatey appears to function as expected. Zscaler does not say this about the Massgrave lure.
WebPulse's reasoning is that this could make detection harder. People tend to raise a ticket when a tool breaks. A tool that seems to work gives them less reason to. Zscaler does not report on whether victims noticed anything.
Both installer versions asked for elevated privileges and hid the PowerShell window. They then saved files to C:\Windows\SystemHealth\Update\, a folder name meant to look like part of Windows. Two scheduled tasks kept the malware running. One of them started it as SYSTEM after a 45-second delay.
Three modules, one operator
Armorsteal is not a single program. Zscaler describes three modules. The Python code is wrapped in a protection tool called Pyarmor, which makes it harder to analyse.
The first module gives remote access. It contacts the attacker's command server every 60 seconds. It fetches more modules and carries out tasks.
The second module watches the user. It logs keystrokes, monitors the clipboard and takes screenshots. Zscaler says its clipboard hijacker supports wallet addresses for nine currencies, including Bitcoin, Ethereum and Solana.
The third module is the collector. Zscaler says it pulls data from web browsers, password managers, crypto wallets, Discord clients and Steam installations. It also records system details such as location, language settings and GPU. Zscaler lists SSH keys among the data targeted.
SSH keys deserve a business reader's attention. They can unlock servers, not just personal accounts.
The operator controls what runs
One design choice stands out. The remote access module checks each task against an embedded RSA-2048 public key before running it. In plain terms, tasks must carry a valid digital signature.
The module also tracks version numbers, so older tasks do not run again. It can download a replacement of its own file after checking a SHA256 hash. Zscaler says this lets the operator update the malware's list of servers and its settings.
This shows a stealer run like a managed product, with signed updates and version control. It is not a one-off script. That is WebPulse's interpretation of the technical detail.
The operator also adapted. Zscaler saw the lure sites move to a new host in mid-September. In early October, the main command domain, workerstats[.]net, became unavailable. The operator began using pymons[.]is and datamons[.]org.
Module downloads then needed a token and a special header. Zscaler says the core malware stayed unchanged through these shifts.
What leaders should ask
These questions are WebPulse's own. They are not Zscaler's published guidance.
First, may staff run commands copied from a web page on a work machine? If so, who decides which sources count as trusted? An internal list of approved software takes the search step out of the process.
Second, can your endpoint tools flag a new scheduled task running as SYSTEM? Can they flag a Python runtime sitting in a Windows-looking folder? Zscaler describes both as traces of this malware.
Third, if an employee ran such a command, how fast could you rotate their SSH keys, saved passwords and Discord tokens? Zscaler lists those among the targets.
A fake site that installs the real tool can make a good disguise. The fix is to control where installs come from. Hoping users spot a typo is not a plan.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Zscaler ThreatLabz.
