Data by Hatching Triage Windows

Arkei

Arkei is a Windows information-stealing malware family that emerged by 2018 and became an influential codebase in the commodity stealer ecosystem.

Profile source: Mallory

Arkei

Family profile

Arkei is a Windows information-stealing malware family that emerged by 2018 and became an influential codebase in the commodity stealer ecosystem. It is primarily known for harvesting credentials and other sensitive data from infected hosts, especially browser-stored information. Public reporting and detection metadata consistently characterize Arkei as a stealer, and multiple later malware families, most notably Vidar, are widely described as forks, variants, or descendants built from Arkei source code. Arkei-derived malware has also been linked through code lineage to later stealer families such as Oski and Mars, underscoring its importance as a foundational family in the evolution of credential theft malware.

Arkei targets Windows systems and focuses on theft of browser and application data. Available technical references indicate functionality associated with extracting data from Chromium- and Mozilla-based browsers, including use of browser-related components and SQLite-backed storage access typical of credential theft operations. As with other stealers in its lineage, Arkei is associated with collection of passwords and related user data, and it has been observed as a payload delivered by other malware, including the Retadup worm. The family is best understood as a commodity infostealer whose significance lies both in its own credential-theft role and in its reuse as a source code base for subsequent malware families.

No high-confidence, broadly corroborated attribution to a specific threat actor is established here. Likewise, the available material does not support a precise, high-confidence statement about a single dominant delivery vector for Arkei itself, beyond observations that it has been distributed as a secondary payload by other malware.

Capabilities

Credential Theft
Exfiltration

Reported operators

Threat actors

1 named in public reporting

Stealth Mango

rule win_arkei_stealer_auto { ... description = "Detects win.arkei_stealer." ... malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.arkei_stealer" ... } ... rule win_arkei_stealer_w0 { ... description = "Arkei Stealer" ... $s1 = "Arkei" ... $s2 = "/server/gate" ... $s3 = "/server/grubConfig" ... $s4 = "\\files\\" ... $s5 = "SQLite" ... }

MITRE ATT&CK

Arkei in ATT&CK

11 distinct techniques

Techniques

11 techniques

T1105 Ingress Tool Transfer T1539 Steal Web Session Cookie T1113 Screen Capture T1555 Credentials from Password Stores T1560 Archive Collected Data T1082 System Information Discovery T1129 Shared Modules T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol T1071 Application Layer Protocol T1555.003 Credentials from Web Browsers T1036 Masquerading

Reporting

Research mentioning Arkei

May 7

Malpedia

Vidar (Malware Family)

Researchers and incident reports show the Vidar infostealer continuing to mature as a credential- and data-theft platform, with operators rotating backend infrastructure, tightening access to affiliate panels, and masking administration through Tor relays, VPN services, and hosting concentrated in Moldova and Russia. Team Cymru linked the operation to infrastructure including my-odin[.]com and several shifting IP addresses, while newer technical analysis found Vidar using multi-stage PowerShell delivery, process injection, API hooking, scheduled-task persistence, and theft of browser data by intercepting CryptProtectMemory before encryption. The malware targets Windows systems and steals credentials, cookies, autofill data, payment cards, crypto-wallet files, tokens, documents, and screenshots, then exfiltrates the data over encrypted channels. Campaigns tied to Vidar have used increasingly flexible command-and-control discovery and broad distribution channels. Analysts observed samples resolving C2 details dynamically through public profiles on Faceit, Telegram, and Steam, allowing operators to change infrastructure without rebuilding malware. Separate reporting tied Vidar to YouTube lures promoting cracked software and AI-generated tutorial videos, where victims were redirected to fake download sites that delivered stealer payloads. Earlier activity also showed Vidar deployed ahead of GandCrab ransomware, stealing victim data before downloading the encryptor, underscoring its role as both a standalone infostealer and a precursor for wider financially motivated intrusions.

Aug 28

Aryaka

Vidar Infostealer in Action From API Hooking to Covert Data Exfiltration

Aug 25

Gatewatcher

Utilisation de faux profils Steam : Vidar Stealer prend les commandes - Gatewatcher

Apr 18

Morphisec

NFT Malware Gets New Evasion Abilities

Threat actors targeted cryptocurrency and NFT communities with phishing messages and spoofed NFT project websites that impersonated legitimate services to trick users into downloading malware. One campaign used a fake Pixelmon site, pixelmon[.]pw, to mimic the real project and deliver ZIP archives containing Windows shortcut and script payloads that installed Vidar infostealer, which steals passwords, cryptocurrency wallet data, and sensitive files. Researchers found Vidar obtained command-and-control details through a Telegram channel and could fetch additional modules from its C2 infrastructure. A separate but related campaign tracked as NFT-001 used Discord and similar forums to lure victims to decoy crypto sites, where a malicious installer deployed Remcos RAT and, in newer variants, Eternity Stealer. Morphisec reported the operators changed tooling from the Babadeda crypter to a staged downloader while keeping similar delivery infrastructure and some overlapping C2 elements. The newer downloader performed a UAC bypass, added C:\ to Microsoft Defender exclusions, and retrieved follow-on payloads to improve evasion and credential theft, showing continued refinement of malware delivery against NFT and crypto users.

Dec 28

The Hacker News

New Rugmi Malware Loader Surges with Hundreds of Daily Detections

Security researchers reported a sharp rise in the Rugmi malware loader, tracked by ESET as Win/TrojanDownloader.Rugmi, after detections jumped from single digits to hundreds per day. Rugmi has been used to deliver multiple information stealers, including Lumma Stealer, Vidar, RecordBreaker, and Rescoms. Analysts said the malware appears in several forms: a downloader that fetches an encrypted payload, a loader that executes a payload embedded in its own resources, and a variant that launches a payload from an external disk file. The activity reflects a broader criminal ecosystem built around commodity malware delivery and remote access abuse. Researchers noted that Lumma Stealer is sold through a malware-as-a-service model and is distributed through malvertising, fake browser updates, cracked software installers, and abuse of Discord CDN infrastructure. Separately, McAfee detailed how attackers have repurposed the legitimate NetSupport remote administration tool as a RAT, with initial access brokers using it against targets in the U.S. and Canada to establish footholds for follow-on compromise.

Nov 30

Medium G0njxa