Loading malware…
Arkanix Stealer is a short-lived information-stealing malware family/operation that surfaced in late 2025 and was advertised in October 2025 on dark web/underground forums and Discord as a malware-as-a-service (MaaS) offering with a web control panel, configurable payloads, and victim statistics. Kaspersky assessed it was likely an AI/LLM-assisted development experiment, with rapid feature shipping and a brief “one-shot” campaign; the affiliate program/control panel and Discord presence were reportedly taken down around December 2025 (roughly two months after launch).
The operation used both (1) a Python-based loader/stealer workflow and (2) a native C++ stealer (premium tier) protected with VMProtect. The initial infection vector was not directly confirmed, but obtained loader filenames suggested phishing/social-engineering lures themed as utilities (e.g., Steam/Discord Nitro/TikTok tools). The Python loader installed dependencies via pip (e.g., requests, pycryptodome, psutil, pywin32), registered the victim to C2 (e.g., POST to hxxps://arkanix[.]pw/api/session/create), fetched the stealer from hxxps://arkanix[.]pw/stealer.py, and executed it. The Python stealer could dynamically update enabled features during execution by querying the panel (e.g., /api/features/{payload_id}) and executed an additional dropper script (hxxps://arkanix[.]pw/upload_dropper.py) prior to collection.
Capabilities described include extensive host and credential/data theft: system profiling (OS/hardware/software/AV/timezone/keyboard layout, etc.); browser theft from a hardcoded list of 22 browsers (including Chrome and Tor Browser) covering history, autofill, saved passwords, cookies, and OAuth2 data from Chromium-based browsers; cryptocurrency-focused collection including wallet-related artifacts and a hardcoded list of crypto-related browser extensions; Telegram session theft (including exfiltration of tdata, with an “optimized” mode); Discord credential theft (including for custom clients) and self-spread via Discord API messaging; VPN credential theft targeting Mullvad, NordVPN, ExpressVPN, and ProtonVPN; and file theft from common user directories with targeted extensions/filenames (including French-language keywords). Stolen data was archived for exfiltration; exfiltration/encrypted payload delivery was described as using AES-GCM with PBKDF2 (HMAC-SHA256) in some components.
The native C++ variant added anti-analysis (anti-sandbox/anti-debug), AMSI and ETW patching (AmsiScanBuffer/EtwEventWrite), RDP credential harvesting by parsing .rdp files, gaming-platform credential theft (Steam, Epic Games, Riot, Origin, Unreal Engine, Ubisoft Connect, GOG, etc.), and screenshot capture. It also embedded and executed an unmodified ChromElevator browser extractor/post-exploitation tool (delivered from resources) intended to bypass Google Chrome App-Bound Encryption protections by injecting into suspended browser processes and extracting browser secrets.
Known infrastructure and indicators mentioned include Cloudflare-fronted domains arkanix[.]pw and arkanix[.]ru hosting the panel/C2 (with arkanix[.]pw also referenced as a C2 endpoint), and a reported C++ User-Agent string of ArkanixStealer/1.0 in some samples. Kaspersky detection names referenced include Trojan-PSW.Win64.Coins., HEUR:Trojan-PSW.Multi.Disco.gen, and Trojan.Python.Agent..
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
20 distinct techniques documented for this family, organized by ATT&CK tactic.
"The Python version was often packed..."; "...bundled using PyInstaller or Nuitka... slightly obfuscated."; "The release version employs VMProtect"
"...implant embedded within the resources of the C++ implementation... stealer extracts the payload to a temporary folder... and executes it"
"...searches for .rdp files in %USERPROFILE%\Documents and extracts the full server address, password, username and server port."
"File retrieval is performed regardless of the configuration... extracted files are packed into a ZIP archive"; "...zips the entire tdata directory... and transmits it"
"...make a POST request to hxxps://arkanix[.]pw/api/session/create... After that, the stealer makes a GET request to hxxps://arkanix[.]pw/stealer.py and executes the downloaded payload."
"...debug version communicates with a Discord bot for command and control (C2)"; "...acquires the list of user’s friends and channels via the Discord API and sends a message"
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Infostealer implemented in C++ and Python.
Information-stealing malware (noted as C++ & Python) described as AI-assisted; reportedly shut down after a brief campaign.
Information-stealing malware offered as MaaS. Uses C++ and packed Python components/loader to download and execute the stealer, register victims to C2, and exfiltrate data. Steals system details, browser data (passwords/cookies/history/autofill and OAuth2 data for Chromium), crypto-wallet data, Telegram sessions, Discord credentials, VPN data, RDP and gaming-related data, screenshots, and selected user files; supports extra modules (e.g., wallet tools, HVNC). Employs anti-analysis, patches AMSI/ETW, encrypts exfil data (AES-GCM + PBKDF2), and self-deletes after execution.
Information-stealing malware family observed active in late 2025, distributed primarily via Discord communities and underground forums while masquerading as legitimate utilities.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.