SEO Poisoning Campaign Delivers Armorsteal Malware

Summary

An SEO poisoning campaign is using fake websites impersonating Chocolatey and Microsoft Activation Scripts to distribute Armorsteal, a Python-based malware family. The malware includes remote access, surveillance, and information-stealing modules designed to exfiltrate sensitive data, including cryptocurrency wallets and browser credentials. The attack relies on Pyarmor obfuscation and establishes persistence automatically through scheduled tasks.

Investigation

Zscaler Threat Hunting uncovered the campaign by tracing poisoned search results to typosquatted domains. Analysts observed the deployment of a Python 3.11 runtime and identified RSA-2048 signatures used to verify commands. The investigation also documented changes in the C2 infrastructure as the threat actor moved between domains and hosting providers.

Mitigation

Organizations should block identified malicious domains and IP addresses across security controls. Defenders should investigate endpoints for unauthorized scheduled tasks and suspicious files stored in Windows system directories. Reviewing Microsoft Defender exclusions and educating users to verify legitimate software download sources can also help reduce exposure to the campaign.

Response

When Armorsteal activity is detected, immediately isolate infected systems and remove unauthorized scheduled tasks such as SysCheck2 and SysCheckX. Hunt for suspicious files under C:\Windows\SystemHealthUpdate and review PowerShell logs for malicious downloads. Monitor outbound HTTPS traffic for known C2 endpoints and inspect browser processes launched with remote debugging ports enabled.

Simulation Execution

• Attack Narrative & Commands: An adversary has successfully tricked a user via SEO poisoning into running a malicious script. The goal is to install the Armorsteal remote access module. To evade detection, the attacker uses a PowerShell script named install.ps1 which, upon execution, creates a deceptive directory structure C:WindowsSystemHealthUpdate to hide its components, masquerading as a legitimate Windows system health update.

• Regression Test Script:

  # Simulation of Armorsteal Installation Pattern
  # Step 1: Create the deceptive directory structure
  $targetDir = "C:WindowsSystemHealthUpdate"
  if (!(Test-Path $targetDir)) {
      New-Item -Path $targetDir -ItemType Directory -Force
  }
  
  # Step 2: Simulate the execution of the malicious installer
  # This command is designed to trigger the 'selection_powershell' and 'selection_directory' logic
  powershell.exe -ExecutionPolicy Bypass -File "install.ps1" -TargetDir "$targetDir"
  
  # Note: Since install.ps1 might not exist locally, we simulate the command line trigger
  # which is what the Sigma rule is actually looking for.
  Start-Process "powershell.exe" -ArgumentList "-File install.ps1"
  
  # Step 3: Create a dummy file in that directory to trigger the 'selection_directory' requirement
  $dummyFile = Join-Path $targetDir "armorsteal_module.dll"
  New-Item -Path $dummyFile -ItemType "File" -Force

• Cleanup Commands:

  # Remove the malicious directory and files created during simulation
  Remove-Item -Path "C:WindowsSystemHealth" -Recurse -Force