Defender exclusion for all of Windows stays behind after Armorsteal is cleaned up
Seqrite Labs reports that Armorsteal can leave a Windows Defender exclusion covering all of C:\Windows even after the malware kit itself has been cleaned up, so removal may not undo the exposure.
- Affected
- Armorsteal build compiled with PyArmor 9.1.7 trial on 2026-10-28T12:56:58.193660
- Fixed
- None supplied
The kit’s miner manager checks Defender every minute and re-adds exclusions for C:\Windows and xmrig.exe; Seqrite says those exclusions remain after cleanup. Zscaler ThreatLabz reports that victims searching for tools such as Chocolatey or Microsoft Activation Scripts land on fake pages and are asked to paste a PowerShell command that installs the real tool while quietly dropping Armorsteal into C:\Windows\SystemHealth\Update.
Blocking a single domain offers little protection because the controller cycles through 11 C2 addresses and settles on the first one that answers. Readers who suspect infection should manually inspect Defender exclusions after any suspected cleanup, since the exclusion can persist even when the malware is gone.
Sources & technical scope 1 source
Seqrite Labs — original source ↗
Affected: Armorsteal build compiled with PyArmor 9.1.7 trial on 2026-10-28T12:56:58.193660
Fixed: None supplied
Exploitation: Observed by Seqrite Labs on one infected Windows machine; on 31 October 2026 two of eleven C2 domains still resolved. No infection count or confirmed victim incidents supplied.
Scope & limitations: Exact infection scale, operator identity, mined coin, and post-remediation removal procedure are not established by the supplied evidence.
External findings belong to the credited researchers.