Zscaler Threat Hunting found an SEO poisoning campaign (September 2026) that ranked lookalike sites for searches like "install Chocolatey" and "Microsoft Activation Scripts". Each site showed a PowerShell one-liner that installed Armorsteal, a Pyarmor-protected Python RAT, keylogger and stealer. The fake Chocolatey command also ran the real installer, so nothing looked wrong.

• Host: scheduled tasks SysCheck2 (at logon, highest privileges) and SysCheckX (SYSTEM, 45 s after boot); a Python 3.11 runtime and SysMon.py, basrq.py, got.py under C:\Windows\SystemHealth\Update\; onetime_version.txt/global_version.txt there; Defender exclusions for C:\Windows.
• Process: browsers started with --remote-debugging-port=9222 (cookie theft over the DevTools protocol), and hidden PowerShell that downloads a ZIP.
• Network: lure domains choclatey[.]org and massgravel[.]net; C2 workerstats[.]net, pymons[.]is, datamons[.]org, standby niceer[.]net, supertrap[.]net; IPs 82.153.135.80, 186.2.175.183, 186.2.163.185, 190.115.31.69, 209.99.186.187. Paths /receive_infof, /get-global, /black-watch/, /infame/receive/; user agent python-requests/2.31.0.
• Note: it exits when ipinfo.io reports a cloud provider, so cloud sandboxes can miss it. Tasks are RSA-signed, so operators can push new code at any time.

Both lure sites are down (Sept 25 and about Oct 1), but C2 moved to new domains in October. The 10 SHA-256 hashes are in Zscaler's report.