- Seqrite Labs analysed Armorsteal, a Python malware kit that steals data and mines crypto. It stops mining when monitoring tools open and slows its reinstall after cleanup.
- Seqrite says file hashes are a weak way to catch it. Steadier signs are Python running from under C:\Windows, started by scheduled tasks, alongside new Defender exclusions.
- Check for leftover Defender exclusions and scheduled tasks after any cleanup, and alert on new exclusions that cover the whole Windows folder.
Malware that watches the person looking for it
When a PC runs slowly, people open Task Manager. A Windows malware kit called Armorsteal is built around that habit. Seqrite Labs analysed an infected machine and found that the kit stops its crypto miner as soon as a monitoring tool opens. The user sees a quiet machine and moves on.
The lesson here is that this kit treats the defender's routine as a design input. Opening Task Manager, deleting a suspicious file and blocking a domain each have an answer built in. Routines such as watching Task Manager, deleting the miner or blocking one domain are each anticipated in this kit's design.
What Seqrite found
Seqrite's team found three scheduled tasks named SysCheck2, SysCheckX and SysHeal. Each launched software from one folder, C:\Windows\SystemHealth\Update. Inside was a toolkit built in Python. It carried a portable Python 3.11 interpreter, so the host needs no Python of its own.
The attackers protected the scripts with the trial version of PyArmor, a tool that encrypts code. Seqrite says trial builds ship the decryption key inside the bundled runtime. That let the researchers decrypt every script and rebuild the logic.
The entry point on this machine remains unobserved by Seqrite. Zscaler ThreatLabz described Armorsteal on 22 October 2026. In Zscaler's account, searches for tools such as Chocolatey or the Microsoft Activation Scripts lead victims to counterfeit pages. Those pages tell them to run a pasted PowerShell command. The command fetches the genuine tool while placing the kit in the folder above. Seqrite says its build is newer than the one Zscaler described.
Four ways it avoids being seen
First, it checks where it runs. It queries ipinfo.io for the owner of its network. A reply naming Google, Amazon, Microsoft or Azure makes it exit with a false "Memory is insufficient" message. Seqrite points out that many automated analysis sandboxes are hosted on those clouds. The payloads stay out of their view.
Second, it limits Defender scanning. Each minute the miner's manager audits Defender's exclusion list. If its own entries are missing, it adds the C:\Windows path and the process xmrig.exe, the miner. An exclusion on the whole Windows folder keeps the kit out of Defender's scans, Seqrite says. The entry also survives cleanup of the malware.
Third, it checks for analysis tools. Every second it looks for any of 20 monitoring tools running. The list includes Task Manager, Process Explorer and Wireshark. If it finds one, it stops the miner. Mining resumes about a second after the tool closes. A tool left open longer than an hour is terminated by the script instead.
Fourth, it expects cleanup. If xmrig.exe disappears, the script waits 2 minutes before reinstalling, then 4, then 8, up to 6 hours. This limits repeated alerts. Seqrite saw this on the machine: the install marker and a driver file, WinRing0x64.sys, were present, but xmrig.exe was gone.
What it takes from a victim
The miner is only part of the kit. Seqrite found a keylogger that saves each keystroke together with the title of the active window. That lets the attacker tie a password to the site where it was typed. A clipboard monitor swaps copied crypto addresses for nine attacker addresses.
A stealer takes Discord login tokens, browser data and files from about 20 wallet browser extensions and 13 desktop wallets. It also scans every drive for text files that look like wallet seed phrases. A separate module copies password-manager vaults, including KeePass, 1Password and Bitwarden.
Seqrite says the stealer does not transfer funds itself. An attacker holding the wallet files plus the wallet password could open them on another machine. The keylogger may already have captured that password.
Why blocking one domain, or one file, falls short
The kit tries 11 domains in order. Seqrite says datamons[.]org, the domain seen on the machine, is only seventh on the list. Blocking it alone does very little.
Control of the backdoor is locked to the operator. Seqrite found that it executes downloaded code only when the code is signed with the attacker's own RSA-2048 key. A rival who seized one of the domains could not feed it commands.
File hashes, the fingerprints defenders often match on, are also poor evidence. Seqrite says each PyArmor rebuild changes them, and the backdoor can alter the kit's behaviour without writing to disk. Seqrite points instead to the pattern around the files. That pattern combines Python running from under C:\Windows, scheduled tasks that launch it, new Defender exclusions and a miner starting up.
Questions for your security team
Ask whether your tools alert on Python running from under C:\Windows. Ask whether a new Defender exclusion, especially one covering the whole Windows folder, raises an alert.
Ask what "cleaned" means after an incident. If it means the malicious file is gone, Seqrite's findings show that is not enough. Check for leftover exclusions and scheduled tasks as well.
Ask how staff get installers such as Chocolatey. Zscaler says infections it traced began at fake download pages. If a machine was affected, consider the wallet seed phrases and password-manager vaults on it as potentially copied.
A quiet Task Manager proves little when the malware is watching it.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Seqrite.
