The Zscaler Threat Hunting team identified an SEO poisoning campaign that distributed Armorsteal through websites impersonating Chocolatey and the Microsoft Activation Scripts (MAS) tool. https://www.zscaler.com/blogs/security-research/seo-poisoning-campaign-delivers-new-armorsteal-malware
www.zscaler.comSEO Poisoning Campaign Delivers Armorsteal Malware | ThreatLabzZscaler Threat Hunting examines an SEO poisoning campaign using fake Chocolatey & MAS sites to deploy Armorsteal malware.