Hunt (queue): SEO poisoning with fake Chocolatey and MAS install pages delivers the Pyarmor-protected 'Armorsteal' Python RAT/stealer

vendor summary (Gurucul threat research digest, Oct 23); original researcher not named, needs the primary write-up2026-10-23

Hunt (queue): SEO poisoning with fake Chocolatey and MAS install pages delivers the Pyarmor-protected 'Armorsteal' Python RAT/stealer

Gurucul digest: in September, fake Chocolatey and Microsoft Activation Scripts sites showed PowerShell install commands that dropped a Python 3.11 runtime and three Pyarmor-obfuscated components for remote access, surveillance and theft. IOCs: choclatey.org, massgravel.net, workerstats.net, pymons.is, datamons.org, niceer.net, supertrap.net; 82.153.135.80, 186.2.175.183, 186.2.163.185, 190.115.31.69, 209.99.186.187; 10 SHA-256 hashes on the page. Find the original research before publishing.

Sources: Gurucul community: SEO Poisoning Campaign Delivers New Armorsteal Malware (Oct 23)