---
title: Someone pasted an install command from a search result (Armorsteal-style SEO lure): confirm, contain, rotate | ctxsec
url: https://ctxsec.com/playbooks/seo-poisoned-install-command-armorsteal
---

[← Playbooks](/playbooks)

# Someone pasted an install command from a search result (Armorsteal-style SEO lure): confirm, contain, rotate

For when a user ran a PowerShell install one-liner from a look-alike site (fake Chocolatey, fake Massgrave/MAS, or similar). Based on Zscaler ThreatLabz's Oct 22 Armorsteal analysis. The payload is a signed-task RAT plus keylogger and stealer, so treat it as hands-on access, not just stolen passwords.

For: SOC, Endpoint / Windows admin, IR lead, Identity admin

[1. Confirm](#s1)[2. Contain](#s2)[3. Rotate](#s3)[4. Prevent the next one](#s4)

1.

Step 1 of 4

__

### Confirm

Check the host for Armorsteal's known artifacts first, then look for the general pattern.

   - Scheduled tasks SysCheck2 and SysCheckX; files under C:\Windows\SystemHealth\Update\ (Python 3.11, SysMon.py, basrq.py, got.py, *_version.txt)
   - PowerShell history and 4104 script-block logs for downloads from choclatey[.]org, community.choclatey[.]org or massgravel[.]net, or any iex/irm from a domain registered in the last 90 days
   - Browsers launched with --remote-debugging-port=9222; Defender exclusions for C:\Windows
   - Proxy/DNS hits for workerstats[.]net, pymons[.]is, datamons[.]org, niceer[.]net, supertrap[.]net and the five Zscaler IPs

2.

Step 2 of 4

__

### Contain

The operator can push new signed Python tasks every 60 seconds.

   - Network-isolate through EDR, preserve memory and the SystemHealth folder, then disable both tasks
   - Block the lure and C2 domains and IPs at DNS and proxy
   - Reimage rather than clean: the remote access module can download and run arbitrary code in memory

3.

Step 3 of 4

__

### Rotate

Assume everything the user typed or stored on that machine is stolen.

   - Revoke SSO sessions and refresh tokens and reset passwords from a clean device; the keylogger saw anything typed since infection
   - Rotate SSH keys, password-manager master passwords (KeePass, 1Password, Bitwarden and others were targeted), Discord and Steam sessions and saved browser credentials
   - Move any crypto from wallets on that host to new seeds, and warn the user that the clipboard hijacker may have changed pasted addresses

4.

Step 4 of 4

__

### Prevent the next one

The lure works because people search for install steps.

   - Publish approved install commands for common tools on an internal page
   - Alert on hidden PowerShell that downloads ZIPs and creates scheduled tasks within minutes
   - Block unofficial activation tools on managed devices

Original content by ctxsec. Printable checklist: use your browser's print view.