Zscaler researchers uncovered an -engine manipulation operation spreading a Pyarmor-obfuscated malware strain dubbed Armorsteal. Attackers lure victims seeking setup instructions for the Chocolatey utility or Microsoft Activation Scripts (MAS) onto fraudulent portals. These bogus sites trick visitors into running a rogue PowerShell script that installs a bundled Python environment alongside three distinct malicious modules. First, the remote control component connects via HTTPS to one of the preconfigured command servers and downloads the secondary payloads as zipped archives. Second, the spying script tracks active application windows and logs keystrokes. Additionally, it generates spoofed Exodus, MetaMask, and Phantom alerts while checking the clipboard to swap copied crypto addresses with attacker-owned wallets. Finally, the harvesting script profiles the infected machine's hardware and location while exfiltrating sensitive files. It extracts data from seven popular password managers, SSH keys, Steam accounts, and Discord application. The stealer also scans all local drives for BIP39 recovery phrases, grabs crypto wallet files and hijacks browser cookies via Chrome’s debugging port.
Symantec protects you from this threat, identified by the following:
Associated malicious indicators are blocked and detected by existing policies within Carbon Black products. The recommended policy at a minimum is to block all types of malware from executing (Known, Suspect, and PUP) as well as delay execution for cloud scan to get maximum benefit from Carbon Black Cloud reputation service.
Machine Learning-based
Observed domains/IPs are covered under security categories in all WebPulse enabled products
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
