Arkanix
Arkanix is an information-stealing malware family first publicly noted in late 2025 and observed in the wild by 2026. Reporting describes it as a new or “next-gen” stealer marketed for theft of sensitive data and short-term financial gain. Arkanix has been characterized as blending rapid Python-based harvesting with stealthier C++ payloads, and as using C++ process injection to bypass Google Chrome App-Bound Encryption. Kaspersky analysis cited in the source material states Arkanix was likely developed as an LLM-assisted experiment and that it was promoted on underground forums in October 2025. The available content identifies it broadly as an infostealer but does not provide specific victim sectors, delivery vectors, threat-actor attribution, or concrete indicators of compromise.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Techniques & procedures
2 distinct techniques documented for this family, organized by ATT&CK tactic.
Privilege Escalation
1 technique
Privilege Escalation
Stealth
1 technique
Stealth
Recent activity
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Information stealer offered as malware-as-a-service; assessed to have been developed with LLM assistance and later taken down, with stolen logs feeding initial access and broader cybercrime ecosystems.
Information-stealing malware (MaaS) reportedly developed with LLM assistance; marketed in underground forums and used to harvest credentials/logs that can be resold for initial access.
Information-stealing malware (“stealer”) described as combining a fast Python-based data-harvesting component with a stealthier C++ payload.
A newly marketed information stealer designed to exfiltrate sensitive data for financial gain.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.