[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Playbooks

Someone pasted an install command from a search result (Armorsteal-style SEO lure): confirm, contain, rotate

For when a user ran a PowerShell install one-liner from a look-alike site (fake Chocolatey, fake Massgrave/MAS, or similar). Based on Zscaler ThreatLabz's Oct 22 Armorsteal analysis. The payload is a signed-task RAT plus keylogger and stealer, so treat it as hands-on access, not just stolen passwords.

For: SOC, Endpoint / Windows admin, IR lead, Identity admin

1. Confirm2. Contain3. Rotate4. Prevent the next one
  1. Step 1 of 4

    Confirm

    Check the host for Armorsteal's known artifacts first, then look for the general pattern.

    • Scheduled tasks SysCheck2 and SysCheckX; files under C:\Windows\SystemHealth\Update\ (Python 3.11, SysMon.py, basrq.py, got.py, *_version.txt)
    • PowerShell history and 4104 script-block logs for downloads from choclatey[.]org, community.choclatey[.]org or massgravel[.]net, or any iex/irm from a domain registered in the last 90 days
    • Browsers launched with --remote-debugging-port=9222; Defender exclusions for C:\Windows
    • Proxy/DNS hits for workerstats[.]net, pymons[.]is, datamons[.]org, niceer[.]net, supertrap[.]net and the five Zscaler IPs
  2. Step 2 of 4

    Contain

    The operator can push new signed Python tasks every 60 seconds.

    • Network-isolate through EDR, preserve memory and the SystemHealth folder, then disable both tasks
    • Block the lure and C2 domains and IPs at DNS and proxy
    • Reimage rather than clean: the remote access module can download and run arbitrary code in memory
  3. Step 3 of 4

    Rotate

    Assume everything the user typed or stored on that machine is stolen.

    • Revoke SSO sessions and refresh tokens and reset passwords from a clean device; the keylogger saw anything typed since infection
    • Rotate SSH keys, password-manager master passwords (KeePass, 1Password, Bitwarden and others were targeted), Discord and Steam sessions and saved browser credentials
    • Move any crypto from wallets on that host to new seeds, and warn the user that the clipboard hijacker may have changed pasted addresses
  4. Step 4 of 4

    Prevent the next one

    The lure works because people search for install steps.

    • Publish approved install commands for common tools on an internal page
    • Alert on hidden PowerShell that downloads ZIPs and creates scheduled tasks within minutes
    • Block unofficial activation tools on managed devices

Original content by ctxsec. Printable checklist: use your browser's print view.