A stealthy malware toolkit dubbed ArmorSteal is now infecting Windows machines by posing as trusted software packages. Once installed, it drains credentials, crypto wallets, Discord accounts—and quietly mines Monero in the background.
How the Attack Unfolds
The Malware Infections originate from search results luring users to fake sites impersonating Chocolatey package manager and Microsoft Activation Scripts tools. These lookalike domains—such as “choclatey[.]org” or “massgravel[.]net”—present instructions to run a PowerShell command. On the surface it installs the legitimate tool, but simultaneously drops ArmorSteal into C:\Windows\SystemHealth\Update, a folder designed to seem benign and part of the Windows system.
The kit is fully Python-based—with its own bundled Python 3.11—and obscured via PyArmor trial mode, making static analysis difficult. However, security researchers successfully unpacked it using open-source tooling. Scheduled tasks named SysCheck2, SysCheckX, and the newer SysHeal are used to maintain persistence and control. These tasks initiate the malware controller and miner manager at login and shortly after system boot. The SysHeal task, first seen in a build from September 2026, also runs the controller under elevated privileges.
The Payloads: Mining, Stealing, Evasion
After installation, ArmorSteal creates a unique victim identifier based on hardware information. It cycles through multiple hard-coded domains—such as pymons[.]is, workerstats[.]net, and datamons[.]org—for command-and-control, making blocking a single domain ineffective. It also checks if its host is running inside major cloud providers like Google, Microsoft, Amazon or Azure—if so, it aborts early with a fake “Memory is insufficient” error, avoiding detection by analysts and sandbox environments.
The miner component downloads a version of XMRig (a Monero miner) packaged in a zip file. Before execution, it verifies the file’s SHA-256 hash, unpacks it, adds C:\Windows to the Defender exclusion list, and monitors the system for over 20 monitoring tools. If any are running, it pauses mining until they’re closed. If removed, it delays reinstallation for variable intervals to evade alerting administrators.
Meanwhile, the theft modules quietly harvest data: keylogging with window titles, clipboard monitoring to replace copied crypto addresses with attacker-owned ones, screenshots triggered by keywords, and promotions of fake alerts to trick wallet users into unlocking them. ArmorSteal also steals Discord tokens, doms of Chromium-based browsers, and data from over a dozen desktop and browser wallet programs. It even hunts for seed phrases, leveraging a public utility called ChromElevator to sidestep Chrome’s App-Bound Encryption. Password managers like KeePass, Bitwarden, 1Password, Dashlane and others are also targeted.
Detection and Defense Tips
Security teams need to watch for unusual scheduled tasks (SysCheck2/X/Heal), Python scripts launched from C:\Windows\SystemHealth\Update, and any registry or system settings that exclude C:\Windows from Defender scans. Blocking all 11 known command server domains, not just individual ones, is recommended. Any suspicious use of PowerShell commands from search results—especially when domains are close typos of legitimate tools—should be treated as high risk. Users who may have installed ArmorSteal should assume credentials and wallet seeds are compromised and reset them from a secure, clean device.
ArmorSteal illustrates how threat actors are advancing well beyond classic ransomware to stealthy multi-function kits that steal identities, crypto assets, and system capacity. Its layered evasion, credential theft, and mining components show just how dangerous tools masquerading as legitimate software can become. Going forward, defenders should prioritize behavior-based detection—especially abnormal Python activity, unusual scheduled tasks, and modified Defender settings—since fake domains and file hashes don’t offer reliable signals.
