Fake Chocolate Lures from ArmorSteal Researchers monitoring ArmorSteal have identified fake Microsoft chocolate sites and executables used in an SEO poisoning campaign. The installers launched legitimate software while silently dropping Python-based malware into C:\windows\SystemHealth\update\, then established persistence using the SysCheck2 and SysCheckX scheduled tasks. The tradecraft combines user deception with low-friction execution: genuine installers reduce suspicion, while the malware steals browser data, tokens, wallet materials, SSH keys, and board crypto addresses. Defenders should prioritize checks for the SystemHealth path, abnormal PowerShell downloads, remote debugging on port 9222, and these two task names. Open sources - closed narratives.

Fake Chocolate Lures from ArmorSteal Researchers monitoring ArmorSteal have identified fake Microsoft chocolate sites and executables used in an SEO poisoning campaign. The installers launched legitimate software while silently dropping Python-based malware into C:\windows\SystemHealth\update\, then established persistence using the SysCheck2 and SysCheckX scheduled tasks. The tradecraft combines user deception with low-friction execution: genuine installers reduce suspicion, while the malware steals browser data, tokens, wallet materials, SSH keys, and board crypto addresses. Defenders should prioritize checks for the SystemHealth path, abnormal PowerShell downloads, remote debugging on port 9222, and these two task names. Open sources - closed narratives.