Arkanix Stealer is a short-lived information-stealing malware family/operation that surfaced in late 2025 and was advertised in October 2025 on dark web/underground forums and Discord as a malware-as-a-service (MaaS) offering with a web control panel, configurable payloads, and victim statistics. Kaspersky assessed it was likely an AI/LLM-assisted development experiment, with rapid feature shipping and a brief “one-shot” campaign; the affiliate program/control panel and Discord presence were reportedly taken down around December 2025 (roughly two months after launch).
The operation used both (1) a Python-based loader/stealer workflow and (2) a native C++ stealer (premium tier) protected with VMProtect. The initial infection vector was not directly confirmed, but obtained loader filenames suggested phishing/social-engineering lures themed as utilities (e.g., Steam/Discord Nitro/TikTok tools). The Python loader installed dependencies via pip (e.g., requests, pycryptodome, psutil, pywin32), registered the victim to C2 (e.g., POST to hxxps://arkanix[.]pw/api/session/create), fetched the stealer from hxxps://arkanix[.]pw/stealer.py, and executed it. The Python stealer could dynamically update enabled features during execution by querying the panel (e.g., /api/features/{payload_id}) and executed an additional dropper script (hxxps://arkanix[.]pw/upload_dropper.py) prior to collection.
Capabilities described include extensive host and credential/data theft: system profiling (OS/hardware/software/AV/timezone/keyboard layout, etc.); browser theft from a hardcoded list of 22 browsers (including Chrome and Tor Browser) covering history, autofill, saved passwords, cookies, and OAuth2 data from Chromium-based browsers; cryptocurrency-focused collection including wallet-related artifacts and a hardcoded list of crypto-related browser extensions; Telegram session theft (including exfiltration of tdata, with an “optimized” mode); Discord credential theft (including for custom clients) and self-spread via Discord API messaging; VPN credential theft targeting Mullvad, NordVPN, ExpressVPN, and ProtonVPN; and file theft from common user directories with targeted extensions/filenames (including French-language keywords). Stolen data was archived for exfiltration; exfiltration/encrypted payload delivery was described as using AES-GCM with PBKDF2 (HMAC-SHA256) in some components.
The native C++ variant added anti-analysis (anti-sandbox/anti-debug), AMSI and ETW patching (AmsiScanBuffer/EtwEventWrite), RDP credential harvesting by parsing .rdp files, gaming-platform credential theft (Steam, Epic Games, Riot, Origin, Unreal Engine, Ubisoft Connect, GOG, etc.), and screenshot capture. It also embedded and executed an unmodified ChromElevator browser extractor/post-exploitation tool (delivered from resources) intended to bypass Google Chrome App-Bound Encryption protections by injecting into suspended browser processes and extracting browser secrets.
Known infrastructure and indicators mentioned include Cloudflare-fronted domains arkanix[.]pw and arkanix[.]ru hosting the panel/C2 (with arkanix[.]pw also referenced as a C2 endpoint), and a reported C++ User-Agent string of ArkanixStealer/1.0 in some samples. Kaspersky detection names referenced include Trojan-PSW.Win64.Coins.*, HEUR:Trojan-PSW.Multi.Disco.gen, and Trojan.Python.Agent.*.
