Arkei

Arkei is a Windows information-stealing malware family that emerged by 2018 and became an influential codebase in the commodity stealer ecosystem. It is primarily known for harvesting credentials and other sensitive data from infected hosts, especially browser-stored information. Public reporting and detection metadata consistently characterize Arkei as a stealer, and multiple later malware families, most notably Vidar, are widely described as forks, variants, or descendants built from Arkei source code. Arkei-derived malware has also been linked through code lineage to later stealer families such as Oski and Mars, underscoring its importance as a foundational family in the evolution of credential theft malware.

Arkei targets Windows systems and focuses on theft of browser and application data. Available technical references indicate functionality associated with extracting data from Chromium- and Mozilla-based browsers, including use of browser-related components and SQLite-backed storage access typical of credential theft operations. As with other stealers in its lineage, Arkei is associated with collection of passwords and related user data, and it has been observed as a payload delivered by other malware, including the Retadup worm. The family is best understood as a commodity infostealer whose significance lies both in its own credential-theft role and in its reuse as a source code base for subsequent malware families.

No high-confidence, broadly corroborated attribution to a specific threat actor is established here. Likewise, the available material does not support a precise, high-confidence statement about a single dominant delivery vector for Arkei itself, beyond observations that it has been distributed as a secondary payload by other malware.