SEO Poisoning Campaign Delivers New Armorsteal Malware

This campaign uses SEO poisoning to lure victims searching for software installation commands to malicious sites that deliver PowerShell scripts deploying Armorsteal malware. The malware is composed of three main components: a remote access module that communicates with command-and-control servers and verifies RSA-2048 signatures on tasks; a surveillance module that logs keystrokes, monitors clipboard activity, hijacks cryptocurrency wallet addresses, and captures screenshots; and an information stealer targeting browser data, Discord tokens, cryptocurrency wallets, seed phrases, passwords, and SSH keys. The malware is Python-based and protected by Pyarmor to hinder analysis. The campaign employs anti-analysis techniques including cloud provider detection and code obfuscation, and the infrastructure supporting the campaign has been observed to change over time.

The malware enables attackers to gain remote access to infected systems, perform surveillance including keystroke logging and clipboard monitoring, hijack cryptocurrency wallet addresses, and steal sensitive information such as browser data, Discord tokens, cryptocurrency wallets, seed phrases, passwords, and SSH keys. This can lead to credential theft, financial loss, and unauthorized system control. The use of anti-analysis techniques complicates detection and response.

No official patch or remediation is indicated for this malware campaign. Defenders should be aware of the SEO poisoning technique delivering malicious PowerShell scripts impersonating legitimate software tools. Mitigation should focus on user education to avoid downloading scripts from untrusted sources, monitoring for suspicious PowerShell activity, and employing endpoint detection solutions capable of identifying Python-based malware and obfuscated code. Since this is not a software vulnerability, no patch is applicable.