Tip: never paste a PowerShell or curl | bash install command from a search result; take it from the project's own site or package docs
Armorsteal spread through look-alike install pages (choclatey, massgravel) that ranked in search for "install Chocolatey" and "MAS activation". The pasted command ran as admin.
- Publish approved install commands for common tools (Chocolatey, winget, Homebrew, Python, Node) on an internal wiki, and point people there.
- Alert on
powershell -w hidden/iex(irm ...)that downloads from newly registered domains, and on scheduled tasks created right after. - Block unofficial "activation script" tools on corporate devices outright. They are a common lure.
- AI agents and coding assistants that search the web for install steps fall for the same trick. Pin trusted documentation sources for them too.
Sources: Zscaler ThreatLabz: SEO Poisoning Campaign Delivers New Armorsteal Malware (Oct 22)