ArmorSteal Malware Steals Passwords and Crypto Wallet Data, Hides Mining When Task Manager Opens

Seqrite has analysed a newer sample of ArmorSteal, a Python-based Windows malware kit distributed through typosquatted pages for tools such as Chocolatey and Microsoft Activation Scripts, which steals credentials and crypto wallet data, swaps copied wallet addresses on the clipboard and runs a hidden Monero-style miner that shuts down whenever Task Manager or another monitoring tool opens. The kit, previously documented by Zscaler ThreatLabz, persists through scheduled tasks, adds itself to Microsoft Defender exclusions and uses 11 command-and-control domains.