Malware News ArmorSteal Malware Steals Passwords and Crypto Wallet Data, Hides Mining When Task Manager Opens

[Brownie2019]

Content source

https://gbhackers.com/armorsteal-malware-attack/

ArmorSteal, a Python-based Windows malware kit. It steals credentials and crypto wallets, hijacks clipboard addresses, and runs a hidden Monero-style miner.

The miner shuts down whenever a user opens Task Manager or another monitoring tool. Zscaler ThreatLabz documented the family on 22 October 2026. The Seqrite sample is newer than that report and an earlier June 2026 build.

Victims searching for Chocolatey or the Microsoft Activation Scripts land on typosquatted pages.

These pages display a PowerShell command that installs the real tool and quietly drops the kit into C:\Windows\SystemHealth\Update.

The kit ships with its own Python 3.11 runtime. Every script is protected with the trial version of PyArmor 9.1.7.

Three scheduled tasks keep it alive: SysCheck2, SysCheckX and the newly observed SysHeal.

The two SYSTEM tasks have no author, which suggests the malware registered them itself.

It queries ipinfo.io and exits with a fake “Memory is insufficient” error if the network owner is Google, Amazon, Microsoft or Azure, which blinds many cloud sandboxes.

Seqrite recovered the code because trial PyArmor builds ship the decryption key inside the bundled runtime.

Seqrite Researchers said that, the controller, SysMon.py, builds a victim ID from the motherboard serial number. It then tries 11 C2 domains in priority order, so blocking datamons[.]org alone achieves little.

ArmorSteal Malware Attack

Read more on:

ArmorSteal Malware Steals Passwords and Crypto Wallet Data, Hides Mining When Task Manager Opens

ArmorSteal, a Python-based Windows malware kit. It steals credentials and crypto wallets, hijacks clipboard addresses, and runs a hidden Monero-style miner.

gbhackers.com

 

[Bot]

Read more on: (link omitted)

Hi Brownie2019, the report is credible, although the primary research adds a few important qualifications.

The decisive step is running the PowerShell command, usually with elevation. Merely visiting the fake page or copying the text does not install ArmorSteal. That execution boundary is the same practical distinction MalwareTips makes with ClickFix-style lures. Zscaler’s original analysis also found that the fake Chocolatey installer installed the genuine program, helping the infection appear successful and harmless.

“Hides mining when Task Manager opens” is accurate shorthand, but it is not rootkit-style process hiding. According to Seqrite’s later analysis, the watchdog checks once per second for Task Manager and 19 other monitoring tools, terminates the miner while one is open, then restarts mining shortly after it closes. If a monitoring tool remains open for over an hour, the malware may terminate the tool instead. Sneaky, though less magical than the headline sounds.

Two other nuances:

• Monero is probable, not confirmed for this build. Seqrite could not retrieve the miner archive to inspect its coin or wallet configuration. It identified XMRig and inferred Monero from an older build.
• Missing Author metadata on the two SYSTEM tasks is only supporting evidence. That field is optional, so its absence alone cannot prove who registered a task.

The most concerning feature may be the persistent Microsoft Defender exclusions: the malware reportedly excludes the entire C:\Windows directory and the miner process. Those exclusions can remain after visible files or tasks are removed, so deleting SysCheck2, SysCheckX, SysHeal, or the SystemHealth\Update folder is not an adequate cleanup.

For anyone who actually ran one of these commands:

1. Disconnect the affected PC and stop using it for accounts or cryptocurrency.
2. From a trusted device, change exposed passwords, revoke active sessions/tokens, enable MFA, and rotate any SSH keys stored on the PC.
3. Treat wallet files, private keys and seed phrases present on that machine as potentially exposed; migrate assets to a newly generated wallet using a clean device.
4. Open a free malware-removal case through Get help. A negative scan would not be sufficient assurance here, particularly when Defender exclusions and SYSTEM persistence are involved.

For prevention, obtain Chocolatey instructions only from its exact official domain, avoid installation commands presented by search advertisements or lookalike sites, and use legitimate Microsoft activation methods. Search results are not package signatures—occasionally they are barely even search results.

Sources

• ClickFix and fake CAPTCHAs asking for Windows + R
• Armorsteal Unpacked: Breaking Down a Python Malware Kit That Steals Data and Mines Crypto | Seqrite
• SEO Poisoning Campaign Delivers Armorsteal Malware | ThreatLabz