OTX Threat: SEO Poisoning Campaign Delivers New Armorsteal Malware

In September 2026, an SEO poisoning campaign distributed Armorsteal malware through fake websites impersonating Chocolatey package manager and Microsoft Activation Scripts (MAS) tool. Victims searching for software installation commands were presented with malicious PowerShell scripts that deployed Python-based malware protected by Pyarmor. The malware consists of three main components: a remote a