---
title: Hunt (queue): SEO poisoning with fake Chocolatey and MAS install pages delivers the Pyarmor-protected 'Armorsteal' Python RAT/stealer | ctxsec
url: https://ctxsec.com/items/gurucul-armorsteal-seo-poisoning-fake-chocolatey-mas
description: ""
status: "vendor summary (Gurucul threat research digest, Oct 23); original researcher not named, needs the primary write-up"
published: 2026-10-23
---

> 

[← Threat Hunting](/hunting) · [markdown](/items/gurucul-armorsteal-seo-poisoning-fake-chocolatey-mas.md)

vendor summary (Gurucul threat research digest, Oct 23); original researcher not named, needs the primary write-up

2026-10-23

### Hunt (queue): SEO poisoning with fake Chocolatey and MAS install pages delivers the Pyarmor-protected 'Armorsteal' Python RAT/stealer

Gurucul digest: in September, fake Chocolatey and Microsoft Activation Scripts sites showed PowerShell install commands that dropped a Python 3.11 runtime and three Pyarmor-obfuscated components for remote access, surveillance and theft. IOCs: choclatey.org, massgravel.net, workerstats.net, pymons.is, datamons.org, niceer.net, supertrap.net; 82.153.135.80, 186.2.175.183, 186.2.163.185, 190.115.31.69, 209.99.186.187; 10 SHA-256 hashes on the page. Find the original research before publishing.

Sources: [Gurucul community: SEO Poisoning Campaign Delivers New Armorsteal Malware (Oct 23)](https://community.gurucul.com/articles/ThreatResearch/SEO-Poisoning-Campaign-Delivers-New-23-10-2026)