Don't Trust the Top Google Result: Armorsteal Steals Passwords via Fake Sites
We tend to trust Google's top results; search for a tool and we click the first link without a second thought. That habit is exactly what a new campaign exploited, uncovered by security firm Zscaler on October 22, 2026. It spreads a new malware family called Armorsteal that steals passwords and crypto wallets and records everything the victim types.
What is SEO poisoning?
Attackers build a site that mimics a well-known tool, on a domain one letter away from the real name, then use SEO tricks to push it to the top of Google. Searchers see it first and trust it.
This campaign targeted people looking for two tools:
- Chocolatey, a popular Windows package manager used by developers and admins.
- Microsoft Activation Scripts (MAS, or Massgrave), unofficial scripts for activating Windows and Office.
According to Zscaler, two typosquatted domains registered in late August and early September 2026 reached high rankings for searches like "install Chocolatey" and "Microsoft Activation Scripts".
How the infection works
Instead of a suspicious download, the fake site showed a ready-to-copy PowerShell command, the same way the real tools explain installation, so nobody grew suspicious. Once run, the script:
- Requests admin rights and hides the console window.
- Downloads an archive into a folder under Windows with a system-sounding name.
- Installs a full Python runtime with the malware scripts, encrypted with Pyarmor.
- For Chocolatey, also runs the genuine installer, so the victim believes everything worked.
What Armorsteal steals
- Browser data: saved passwords, session cookies that can unlock accounts without a password, and autofill data.
- Crypto: 21 wallet extensions and apps, plus a drive-wide search for seed phrases.
- Password managers: including KeePass, 1Password, Bitwarden and Dashlane.
- Other accounts: Discord tokens, Steam sessions and SSH keys.
The surveillance module logs keystrokes, watches the clipboard and swaps crypto wallet addresses when you copy them, so a payment goes to the attacker instead. It also takes screenshots when certain keywords appear.
Built to hide
Armorsteal persists through two scheduled tasks that run at logon and at boot. If it detects it is running on Google, Amazon or Microsoft cloud servers, where researchers usually analyze malware, it shows a fake "insufficient memory" error and quits. Zscaler says the operators rotated their command servers in early October and added a new verification layer, so the campaign is still evolving even though the lure sites are down.
How to protect yourself
- Download software only from official sites, and bookmark them instead of searching each time.
- Check the domain letter by letter before downloading anything.
- Never paste PowerShell or Terminal commands from sites you don't fully trust.
- Avoid unofficial activators and pirated software, some of the most common malware lures.
- Double-check wallet addresses after pasting, comparing the first and last characters.
- Turn on two-factor authentication so a stolen password isn't enough.
Signs your PC may be infected
If you searched for Chocolatey or Windows activation tools in September or early October 2026 and ran a command from an unofficial site, check (or ask a specialist to check) for:
- Scheduled tasks named SysCheck2 or SysCheckX.
- A folder at C:\Windows\SystemHealth\Update, which is not part of Windows.
- Microsoft Defender exclusions you didn't add, especially for the Windows folder.
If you find any of these, disconnect the PC, change passwords from a clean device, move crypto to a new wallet with a new seed phrase, and reinstall Windows or get professional help.
The bottom line
Armorsteal is a strong reminder that ranking first on Google doesn't mean safe, and that attackers now imitate the methods users trust. Official sources, careful domain checks and caution with any command you don't understand will protect you from most of these traps.
Source: Zscaler ThreatLabz report (October 22, 2026) and SecurityOnline.
Because searching online is our daily gateway to everything, our interest extends from following Arabic websites and specialized blogs, to what Egypt stores, Kuwait stores, vitamin stores and international sites offer, with Mashhor for social media services as a key to growth.
That's it, friends. We hope you found this useful ✌
Best wishes from the #Ezznology team.
Join our community on Telegram and our Facebook group, and follow us on Google News.
You may also like:
What Is Phishing and How to Protect Yourself
Windows October 2026 Update: Microsoft Fixes 1,411 Flaws Including an Exploited Zero-Day
