[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fV1cw2dN4pD1QtEI0db7Jwv-TKbhm7vMpdxNFywDRzpE":3},{"article":4,"iocs":40,"watch_terms":60,"solutions":61,"lesson":151},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":27,"category":28,"article_tags":32},"54f1c685-e205-4a5d-b9c8-fa48e6295922","Hackers Deploy ArmorSteal Malware Through Fake Software Downloads to Steal Credentials and Mine Crypto","hackers-deploy-armorsteal-malware-through-fake-software-downloads-to-steal-crede-9bfd18","Hackers are spreading a Python-based malware kit called ArmorSteal through fake software download pages. The kit steals passwords, crypto wallets and Discord accounts, and it also mines Monero in the background. Seqrite Labs found a newer build of the kit on an infected Windows machine and rebuilt its full logic. ArmorSteal malware ArmorSteal reaches victims […] The post Hackers Deploy ArmorSteal Malware Through Fake Software Downloads to Steal Credentials and Mine Crypto appeared first on Cyber Security News.","A Python-based malware kit named ArmorSteal is being distributed through fake software download pages, masquerading as legitimate tools like Chocolatey and Microsoft Activation Scripts. Once installed, it steals user credentials, crypto wallets, and Discord accounts, while also mining Monero in the background. Researchers have identified its sophisticated evasion techniques, including checking for sandboxes and actively avoiding detection by monitoring tools.","ArmorSteal malware spreads via fake software downloads, stealing credentials and mining crypto.","https:\u002F\u002Fcybersecuritynews.com\u002Farmorsteal-malware\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FArmorSteal-malware.webp","2026-11-09T08:55:53+00:00","2026-11-09T09:00:22.849767+00:00",8,[17,20,23,25],{"name":18,"type":19},"ArmorSteal","product",{"name":21,"type":22},"Python","technology",{"name":24,"type":19},"Chocolatey",{"name":26,"type":19},"Microsoft Activation Scripts","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":27,"icon":29,"name":30,"slug":31},null,"Malware","malware",[33,35],{"category":34},{"id":27,"icon":29,"name":30,"slug":31},{"category":36},{"id":37,"icon":29,"name":38,"slug":39},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[41,45,48,51,53,55,57],{"type":42,"value":43,"context":44},"domain","choclatey[.]org","Fake Chocolatey package manager download site.",{"type":42,"value":46,"context":47},"massgravel[.]net","Fake Microsoft Activation Scripts download site.",{"type":42,"value":49,"context":50},"pymons[.]is","Command and control server for ArmorSteal.",{"type":42,"value":52,"context":50},"workerstats[.]net",{"type":42,"value":54,"context":50},"datamons[.]org",{"type":31,"value":18,"context":56},"Name of the malware kit.",{"type":31,"value":58,"context":59},"XMRig","Cryptomining software used by ArmorSteal.",[18,24,26],{"controls":62,"vendors":144},[63,89,118],{"slug":64,"name":65,"problem":66,"products":67},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",[68,76,81],{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","allowlisting","Allowlisting","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fallowlisting","Blocks any software that has not been approved, including ransomware and unapproved remote-access tools. A learning period builds the approved list first.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":77,"product_name":78,"url":79,"description":80},"ringfencing","Ringfencing","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fringfencing","Limits what approved applications may do, such as which files, network locations and other programs they can reach, so a compromised application cannot be turned against you.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"airlock-digital","Airlock Digital","\u002Fvendor-logos\u002Fairlock-digital.png","airlock-allowlisting","Airlock Allowlisting and Execution Control","https:\u002F\u002Fwww.airlockdigital.com\u002F","Blocks anything not explicitly trusted from running, with tools to build and keep the trusted list current as software changes.",{"slug":90,"name":91,"problem":92,"products":93},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[94,102,110],{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"slug":119,"name":120,"problem":121,"products":122},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[123,131,138],{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":132,"product_name":135,"url":136,"description":137},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":139,"product_name":140,"url":142,"description":143},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",[145],{"slug":146,"name":147,"logo_path":148,"roles":149},"zscaler","Zscaler","\u002Fvendor-logos\u002Fzscaler.png",[150],"reported_by",{"slug":152,"title":153,"body":154,"framework_refs":155,"framework_notes":163},"armorsteal-malware-hides-in-fake-software-downloads-to-steal-credentials-and-mine-crypto","ArmorSteal Malware Hides in Fake Software Downloads to Steal Credentials and Mine Crypto","ArmorSteal exploits users' trust in well-known software brands like Chocolatey and Microsoft Activation Scripts, tricking them into downloading malware disguised as legitimate tools. Once executed, the malware exfiltrates credentials, crypto wallets, and Discord accounts while covertly mining Monero, causing both financial and reputational harm. This attack succeeds primarily because users lack the awareness to verify software authenticity before installation. The malware's sandbox-evasion and anti-detection techniques further highlight how modern threats are engineered to bypass conventional defenses, making proactive user education and verified software sourcing essential lines of defense.",[156,157,158,159,160,161,162],"CIS Control 14: Security Awareness and Skills Training","CIS Control 7: Continuous Vulnerability Management","MITRE ATT&CK T1566: Phishing","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIST SP 800-53 SI-2: Flaw Remediation","OWASP A06:2021 Vulnerable and Outdated Components",{"MITRE ATT&CK T1566: Phishing":164,"NIST SP 800-53 SI-2: Flaw Remediation":165,"OWASP A06:2021 Vulnerable and Outdated Components":166,"CIS Control 7: Continuous Vulnerability Management":167,"CIS Control 14: Security Awareness and Skills Training":168,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":169,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":170},"ArmorSteal's distribution through fake software pages is a form of spear-phishing via service, and ATT&CK T1566 directly maps to this initial-access technique, guiding defenders on detection and mitigation.","Maintaining an inventory of approved software and enforcing integrity checks ensures that only authenticated, unmodified tools are executed, directly countering trojanized fake downloads.","Downloading software from unverified third-party sources introduces untrusted components into the supply chain; this OWASP risk category mandates verifying component integrity and provenance.","Regularly scanning for and restricting unapproved or unverified software in the environment would have reduced the attack surface that ArmorSteal exploits via fake installers.","Users were deceived by convincing impersonations of trusted software; structured, recurring awareness training would help employees recognize and avoid fake download pages.","A formal process for approving and verifying software before installation—as required by this control—would prevent unvetted, malicious packages from entering the environment.","The malware targets stored credentials and session tokens; enforcing multi-factor authentication and least-privilege access would limit the damage from stolen credentials."]