---
title: Hunt: fake Chocolatey and Massgrave install pages in search results deliver Armorsteal; look for SysCheck2/SysCheckX tasks and C:\Windows\SystemHealth\Update | ctxsec
url: https://ctxsec.com/items/hunt-armorsteal-fake-chocolatey-massgrave-seo
description: ""
status: "confirmed research (Zscaler ThreatLabz, Oct 22); IOCs and detection points are Zscaler's"
published: 2026-10-24
---

> 

[← Threat Hunting](/hunting) · [markdown](/items/hunt-armorsteal-fake-chocolatey-massgrave-seo.md)

confirmed research (Zscaler ThreatLabz, Oct 22); IOCs and detection points are Zscaler's

2026-10-24

### Hunt: fake Chocolatey and Massgrave install pages in search results deliver Armorsteal; look for SysCheck2/SysCheckX tasks and C:\Windows\SystemHealth\Update

Zscaler Threat Hunting found an SEO poisoning campaign (September 2026) that ranked lookalike sites for searches like "install Chocolatey" and "Microsoft Activation Scripts". Each site showed a PowerShell one-liner that installed **Armorsteal**, a Pyarmor-protected Python RAT, keylogger and stealer. The fake Chocolatey command also ran the real installer, so nothing looked wrong.

- **Host:** scheduled tasks `SysCheck2` (at logon, highest privileges) and `SysCheckX` (SYSTEM, 45 s after boot); a Python 3.11 runtime and `SysMon.py`, `basrq.py`, `got.py` under `C:\Windows\SystemHealth\Update\`; `onetime_version.txt`/`global_version.txt` there; Defender exclusions for `C:\Windows`.
- **Process:** browsers started with `--remote-debugging-port=9222` (cookie theft over the DevTools protocol), and hidden PowerShell that downloads a ZIP.
- **Network:** lure domains `choclatey[.]org` and `massgravel[.]net`; C2 `workerstats[.]net`, `pymons[.]is`, `datamons[.]org`, standby `niceer[.]net`, `supertrap[.]net`; IPs 82.153.135.80, 186.2.175.183, 186.2.163.185, 190.115.31.69, 209.99.186.187. Paths `/receive_infof`, `/get-global`, `/black-watch/`, `/infame/receive/`; user agent `python-requests/2.31.0`.
- **Note:** it exits when `ipinfo.io` reports a cloud provider, so cloud sandboxes can miss it. Tasks are RSA-signed, so operators can push new code at any time.

Both lure sites are down (Sept 25 and about Oct 1), but C2 moved to new domains in October. The 10 SHA-256 hashes are in Zscaler's report.

Sources: [Zscaler ThreatLabz: SEO Poisoning Campaign Delivers New Armorsteal Malware (Oct 22)](https://www.zscaler.com/blogs/security-research/seo-poisoning-campaign-delivers-new-armorsteal-malware)