ArmorSteal Unpacked: What This Python Malware Kit Steals and Mines

ArmorSteal malware is a Python-based Windows kit that steals credentials and cryptocurrency-wallet data, hijacks the clipboard, and runs a hidden cryptocurrency miner that shuts itself off whenever monitoring tools open. It ships its own portable Python runtime, so it works on any Windows machine. Every script is protected with obfuscated code from the commercial packer PyArmor, so nothing on disk is directly readable.

Zscaler’s ThreatLabz team documented ArmorSteal publicly on 22 October 2026. An independent researcher had already described an older build, with a bundled miner, in June 2026, per Seqrite’s own account. Seqrite’s own write-up, published 6 November 2026, examined a newer build taken from an infected Windows machine and decrypted its PyArmor-protected code to show how the kit currently works.

What Is ArmorSteal Malware, and What Does It Steal?

Zscaler describes three parts working together, and Seqrite’s later build adds a fourth.

• A remote-access module that talks to the attacker’s server and only runs a received command after checking a cryptographic signature.
• A surveillance module that logs keystrokes and watches the clipboard every half second.
• An infostealer module that targets browsers, Discord and cryptocurrency wallets.
• A miner-management module, which Seqrite found in its later build, that installs and runs a hidden cryptocurrency miner.

Seqrite could read the code because the attackers used PyArmor’s trial version. In a trial build, PyArmor ships the decryption key inside its own runtime file. Seqrite used a public tool built for that trial weakness to recover readable source code, a disassembly and a string dump for every script.

The stealing module reaches for saved browser passwords, cookies and autofill data. It also reaches for vaults from seven password managers that both vendors name: KeePass, 1Password, Bitwarden, Dashlane, RoboForm, Password Safe and Enpass. Zscaler says it validates tokens from 22 Discord client variants. Seqrite’s later build checks four Discord apps instead, a smaller set in that one sample.

Seqrite also found a background search across every drive for files holding cryptocurrency seed phrases, flagging lines of 12 to 25 words that match the standard BIP-39 word list. A matching file is copied and sent to the attacker separately from the stolen wallet data.

Both vendors describe the same clipboard hijacker. It watches what the user copies and swaps a cryptocurrency wallet address for the attacker’s own, across nine coins including Bitcoin, Ethereum and Monero. Both also describe fake transaction notifications that copy the look of Exodus, MetaMask and Phantom, timed to get a victim to open and unlock a wallet.

How the Infection Starts

Zscaler traced the campaign to SEO poisoning: fake pages built to rank for searches for the Chocolatey package manager and for Microsoft Activation Scripts. A visitor who runs the PowerShell command shown on the page gets the real tool installed too, so nothing looks wrong, while the command quietly installs ArmorSteal’s remote-access module.

The installer asks for elevated rights and hides its console window. It also registers scheduled tasks disguised as routine system-health checks, so the remote-access module restarts at every logon or boot.

Before doing anything else visible, that module checks the network’s owner through a public lookup service. It exits with a fake error if the answer names a major cloud provider, a step both vendors say is meant to dodge automated analysis.

1. Poisoned search resultSearch Resultsleads to a lookalike site
2. PowerShell install commandFake Installerruns with elevated rights
3. Backdoor module startsWindows Hostbegins at logon or at boot
4. Keylogger and clipboard watcherWindows Hostrecords keystrokes, swaps wallet addresses
5. Stolen data uploadedAttacker Server

What Changed Between Zscaler’s Report and Seqrite’s

Zscaler’s September build used four hardcoded addresses for its command server, checking which one answered before using it. Seqrite’s November build carries eleven addresses instead, so a single takedown does far less. Seqrite found only two of the eleven still resolved when it checked.

Zscaler’s build has no mining component. Seqrite’s build adds one, and could not recover the actual miner program to confirm which coin it mines, because the download link no longer worked by the time researchers checked. Based on an earlier build that did include a working miner, Seqrite says Monero is the most likely coin.

Seqrite also found that the miner-management module checks, about once a second, whether any of twenty monitoring tools is open, including Task Manager and Process Explorer. If one is open, it kills the miner immediately. It restarts the miner roughly a second after the tool closes, so a user who opens Task Manager to check a loud fan sees a quiet machine.

Seqrite also says the module adds an unauthorized exclusion for the whole Windows system folder in Microsoft Defender. That exclusion hides the rest of the kit’s files from the same scanner.

What Changes for Defenders

Seqrite’s own conclusion makes the key point for defenders: because each PyArmor rebuild changes file hashes, hashes alone are a weak way to detect ArmorSteal. The steadier signal is behavior: Python code running from inside the Windows system folder, launched by scheduled tasks, adding security-tool exclusions and starting a hidden miner.

Both vendors also note that the remote-access module only runs a received command after checking a cryptographic signature from the attacker’s own key. That design keeps control of infected machines with whoever holds the key, even after a domain is taken down, so domain blocking alone will not fully contain it.

Among Zscaler’s own remediation advice, four actions avoid repeating an indicator here; Zscaler’s post lists more, including blocking the confirmed malicious domains and watching for the installer’s distinctive remote-debugging-port use.

• Hunt for the disguised scheduled tasks and the system folder they point to.
• Review PowerShell logs for the fake installer commands.
• Remove any unauthorized Microsoft Defender exclusion.
• Watch outbound HTTPS traffic to the campaign’s command-and-control paths.

Teams exposed to this campaign should also treat any already-stolen Discord tokens, saved passwords or wallet files as compromised, and rotate or move them. That last step is ours; neither vendor’s report states it as a formal remediation.