---
title: Tip: never paste a PowerShell or curl | bash install command from a search result; take it from the project's own site or package docs | ctxsec
url: https://ctxsec.com/items/tip-copy-install-one-liners-from-project-domain
description: ""
status: "tip based on Zscaler ThreatLabz Armorsteal research (Oct 22)"
published: 2026-10-24
---

> 

[← Tips & Guides](/tips) · [markdown](/items/tip-copy-install-one-liners-from-project-domain.md)

tip based on Zscaler ThreatLabz Armorsteal research (Oct 22)

2026-10-24

### Tip: never paste a PowerShell or curl | bash install command from a search result; take it from the project's own site or package docs

Armorsteal spread through look-alike install pages (`choclatey`, `massgravel`) that ranked in search for "install Chocolatey" and "MAS activation". The pasted command ran as admin.

- Publish approved install commands for common tools (Chocolatey, winget, Homebrew, Python, Node) on an internal wiki, and point people there.
- Alert on `powershell -w hidden` / `iex(irm ...)` that downloads from newly registered domains, and on scheduled tasks created right after.
- Block unofficial "activation script" tools on corporate devices outright. They are a common lure.
- AI agents and coding assistants that search the web for install steps fall for the same trick. Pin trusted documentation sources for them too.

Sources: [Zscaler ThreatLabz: SEO Poisoning Campaign Delivers New Armorsteal Malware (Oct 22)](https://www.zscaler.com/blogs/security-research/seo-poisoning-campaign-delivers-new-armorsteal-malware)