Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
12 IOCs
SEO Poisoning Campaign Delivers New Armorsteal Malware
Excerpt
IntroductionIn September 2026, Zscaler Threat Hunting identified an SEO poisoning campaign that used fake websites impersonating the Chocolatey package manager and the Microsoft Activation Scripts (MAS) tool to distribute a Python-based malware family we track as Armorsteal. The fake websites targeted users searching for Chocolatey or MAS software installation commands. Each lure page displayed a malicious PowerShell command that downloaded and executed the Armorsteal…
Read the original report →Diamond Model
Adversary
Infrastructure(6)
Capability
Victim
Indicators of Compromise
Open the mindmap →12 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | choclatey.org | High | Score 58/100 | First seen |
| Domain | massgravel.net | High | Score 58/100 | First seen |
| SHA256 | c1146fbcaa433385839c25839a61cd7fedaff858cc0d3fd063dba68db2cf31b4 | Medium | Score 53/100 | First seen |
| IP | 82.153.135.80 | High | Score 58/100 | First seen |
| Domain | 104.21.87.146.in | High | Score 58/100 | First seen |
| IP | 186.2.175.183 | High | Score 58/100 | First seen |
| IP | 209.99.186.187 | High | Score 58/100 | First seen |
| Domain | datamons.org | High | Score 58/100 | First seen |
| Domain | community.choclatey.org | High | Score 58/100 | First seen |
| Domain | pymons.is | High | Score 58/100 | First seen |
| Domain | workerstats.net | High | Score 58/100 | First seen |
| Domain | chocolatey.org | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…