Loading story…
A new information-stealing malware named Arkanix has emerged, targeting users for short-term financial gain. Arkanix is distributed primarily through Discord, masquerading as legitimate tools or being shared on online forums. The malware has evolved rapidly, with an initial Python-based version and a more advanced C++ implementation now available as a "Premium" option. The C++ version leverages process injection techniques to bypass Chrome's app-bound encryption, allowing it to extract sensitive data such as credentials, VPN accounts, Steam accounts, screenshots, and Wi-Fi credentials. The threat actors behind Arkanix also employ obfuscation tools like VMProtect to evade detection and offer a web-based control panel accessible via invite codes distributed on Discord.
Security researchers have noted that Arkanix is likely designed for quick, short-term profit, with its operators focusing on rapid development and distribution rather than long-term campaigns. The malware's web panel provides various options for managing stolen data and customizing payloads, indicating a level of sophistication in its operation. The use of C++ process injection to defeat Chrome's encryption mechanisms marks a notable advancement in stealer malware capabilities, raising concerns about the effectiveness of current browser security measures against such threats.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
Follow-up reporting highlighted that Arkanix’s native C++ version can bypass Google Chrome’s App-Bound Encryption using process injection. This added technical detail emphasized the stealer’s more advanced browser-credential theft capability.
G DATA reported a newly discovered information-stealing malware family called Arkanix, distributed mainly via Discord and online forums for short-term financial gain. Their analysis described both Python and C++ variants, the malware’s data-theft capabilities, infrastructure, and indicators of compromise.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Arkanix Stealer** emerged as a previously undocumented infostealer offered under a **malware-as-a-service (MaaS)** model, promoted via dark web forum advertisements that directed buyers to a Discord server for coordination. Analysis identified multiple implants, including a native **C++** variant with broad data-theft capabilities (e.g., system profiling and **cryptocurrency wallet** theft) and a **Python** implementation that can dynamically modify its configuration and is often packed to hinder analysis. The toolset also incorporated *ChromElevator*, a publicly available browser post-exploitation utility, and detections were mapped to families such as `Trojan-PSW.Win64.Coins.*` and `Trojan.Python.Agent.*`; the associated affiliate/referral program appeared to have been taken down, suggesting a short-lived operation. Separately, January 2026 telemetry and case analysis on infostealer distribution highlighted ongoing, high-volume delivery via **crack/keygen camouflage** and **SEO poisoning**, with prominent families including **LummaC2**, **Vidar**, and **ACRStealer**. The reporting emphasized automated collection and analysis pipelines that extract C2/IOC data and support near-real-time blocking via an indicator service, underscoring that infostealer operations continue to rely on scalable distribution and obfuscation techniques even as individual MaaS offerings like Arkanix may be transient.
Jun 29, 2026
Google introduced **Application-Bound Encryption** in Chrome 127 for Windows to reduce browser-cookie theft by malware running as the logged-in user. The protection routes decryption through a privileged service that validates Chrome’s application identity, replacing reliance on DPAPI alone and raising the bar for attackers to obtain SYSTEM privileges or inject code into Chrome. Google began the migration with cookies and plans to extend it to passwords, payment data, and other persistent authentication tokens. Infostealer families including **STEALC/VIDAR**, **MetaStealer**, **Phemedrone**, **XenoStealer**, and **Lumma** adapted by scraping plaintext cookies from Chrome process memory, abusing the Chrome elevation service through COM, injecting into browser processes, or enabling Chrome remote debugging to recover session tokens. Subsequent Hannibal Stealer research also examined the contest between browser protections and credential-stealing malware. Defenders can detect these bypasses through anomalous Chrome child-process activity, memory access, access to cookie files or elevation-service registry keys, localhost debugging traffic, and untrusted code placed in Chrome application directories.
Sep 9, 2026
Researchers reported that the `VoidStealer` infostealer is using a new debugger-based technique to bypass Google Chrome’s Application-Bound Encryption (ABE) and steal the browser’s `v20_master_key` from memory. Gen Digital said the malware, offered as a Malware-as-a-Service operation and advertised on forums including HackForums, captures the key at the brief moment it appears in plaintext during browser startup, then uses it to decrypt protected browser data from Chrome and Microsoft Edge. The method relies on standard Windows debugging APIs and hardware breakpoints rather than code injection, browser memory modification, or elevated privileges, making it quieter than earlier ABE bypasses. Researchers said this is the first publicly reported infostealer observed in the wild using this mechanism, likely adapted from the open-source `ElevationKatz` project in the `ChromeKatz` toolset. The finding raises concern that other stealers may adopt the same approach, and defenders were urged to watch for suspicious debugger attachment to browser processes, hidden or headless browser launches, and unexpected memory reads targeting browsers.
Jun 29, 2026