Loading story…
Arkanix Stealer emerged as a previously undocumented infostealer offered under a malware-as-a-service (MaaS) model, promoted via dark web forum advertisements that directed buyers to a Discord server for coordination. Analysis identified multiple implants, including a native C++ variant with broad data-theft capabilities (e.g., system profiling and cryptocurrency wallet theft) and a Python implementation that can dynamically modify its configuration and is often packed to hinder analysis. The toolset also incorporated ChromElevator, a publicly available browser post-exploitation utility, and detections were mapped to families such as Trojan-PSW.Win64.Coins.* and Trojan.Python.Agent.*; the associated affiliate/referral program appeared to have been taken down, suggesting a short-lived operation.
Separately, January 2026 telemetry and case analysis on infostealer distribution highlighted ongoing, high-volume delivery via crack/keygen camouflage and SEO poisoning, with prominent families including LummaC2, Vidar, and ACRStealer. The reporting emphasized automated collection and analysis pipelines that extract C2/IOC data and support near-real-time blocking via an indicator service, underscoring that infostealer operations continue to rely on scalable distribution and obfuscation techniques even as individual MaaS offerings like Arkanix may be transient.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
On 2026-02-19, Securelist published a detailed analysis of Arkanix Stealer, describing its Python and C++ variants, control panel behavior, data theft scope, and use of ChromElevator. The report also highlighted anti-analysis features, AMSI/ETW patching, and AES-GCM exfiltration in the C++ stealer.
On 2026-02-18, AhnLab published its January 2026 infostealer trend report summarizing activity collected through its internal systems and shared related indicators through its ATIP service. The report covered Windows and macOS delivery trends, including ClickFix-style terminal abuse on macOS.
In its January 2026 case study, AhnLab described MacSync Stealer being delivered through a fake GitHub page that executed a Base64-decoded zsh command to fetch additional scripts from sestraining.com. The chain ultimately ran an osascript stealer and exfiltrated collected data such as /tmp/osalogging.zip to command-and-control infrastructure.
During January 2026, AhnLab documented an ACRStealer variant that replaced hardcoded-key AES with ECDH key exchange on SECP256R1 and ChaCha20-Poly1305. The variant also added an X-Requests-Key header for session tracking.
In January 2026, AhnLab observed infostealer distribution heavily using crack/keygen themes and SEO poisoning, including abuse of legitimate but poorly managed WordPress sites. LummaC2, Vidar, and ACRStealer were the main families seen in this delivery channel.
Around December 2025, the Arkanix web panel and associated Discord presence appeared to go offline, suggesting the operation was short-lived. Its known infrastructure included arkanix[.]pw and arkanix[.]ru, both fronted by Cloudflare.
During late 2025, Arkanix operators distributed Python- and C++-based stealers using loader filenames suggesting phishing or social-engineering themes tied to Steam, Discord Nitro, and TikTok tools. The malware targeted browser data, messaging accounts, VPN credentials, wallet extensions, gaming credentials, and files of banking or cryptocurrency interest.
In October 2025, researchers found forum advertisements for a previously unknown malware-as-a-service infostealer called Arkanix Stealer. The offering included malware implants and a web-based control panel with configurable payloads and victim statistics.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft, Europol, law enforcement agencies, and multiple private-sector partners carried out a coordinated disruption of the **StealC** infostealer and **Amadey** loader ecosystems, using court orders and related legal actions to target both malware operations at once. The operation struck a broad criminal infrastructure spanning more than 200 command-and-control domains and IP addresses, with partner reporting citing **66 domains** and **296 servers** tied to the two services. Microsoft said the malware families were linked to more than **140,000 infected computers** in a single week in May, while partner investigators reported the seizure of **25.6 million unique credentials** stolen from more than **385,000 compromised systems**. Investigators said **StealC**, active since 2023 as a malware-as-a-service infostealer, was used to steal browser data, credentials, email and messaging data, VPN and cloud access, and cryptocurrency wallet information, while **Amadey**, active since 2018, functioned as a modular loader and backdoor that frequently delivered StealC and other payloads. Researchers also identified a vulnerability in the StealC command-and-control panel that helped support search-and-seizure actions, and they used configuration extraction and a custom emulator to map affiliate activity and delivery chains. The two malware families were described as part of a broader cybercrime ecosystem tied to credential theft, access brokering, and downstream attacks including ransomware, with observed links to payloads such as **AsyncRAT**, **RedLine**, **Vidar**, **XMRig**, and in one case **LockBit Black**.
Jul 12, 2026
Threat researchers reported continued growth in the **infostealer** ecosystem, with new families emphasizing theft of browser credentials, session cookies, and cryptocurrency wallet data. Zscaler ThreatLabz detailed **Marco Stealer**, first observed in June 2025, which profiles infected hosts (e.g., OS version, hardware ID, IP/geolocation) and targets browser data plus cryptocurrency wallet information from browser extensions; it also searches for sensitive files in local and **cloud-synced** locations, including folders associated with *Dropbox* and *Google Drive*, and uses anti-analysis measures such as runtime string decryption. Separately, Cyfirma described **LTX Stealer**, a Windows-focused infostealer built around a bundled **Node.js runtime** and delivered via an Inno Setup installer (`Negro.exe`) that drops an unusually large (~271 MB) payload—reportedly to evade scanning heuristics. LTX Stealer targets Chromium-based browsers by extracting keys from `Local State` to decrypt saved passwords and cookies, collects screenshots, and stages data for exfiltration while using services such as *Supabase* (authentication) and *Cloudflare* (infrastructure masking). Flare’s research contextualized these developments as part of an “infostealer arms race,” observing multiple variants being marketed/updated across dark web forums and highlighting the downstream impact: analysis of **18.7M** infostealer logs (2025) found enterprise SSO/IdP credentials in more than 10% of infections, and Verizon DBIR data cited by Flare linked infostealer credential exposure to a significant share of ransomware victimization; Flare also noted stealer developers rapidly adapting to Chrome’s evolving credential protections (e.g., post-`v127` application-bound encryption and newer Chrome releases).
Jun 29, 2026
PhantomStealer v3.5.0 was deployed in multiple phishing campaigns using invoice, RFQ, maritime, and industrial lures delivered as heavily obfuscated JavaScript droppers. Across the observed samples, the malware followed a consistent multi-stage chain: Windows Script Host launched PowerShell, decrypted additional payloads, reflectively loaded .NET components, and hollowed the signed Microsoft binary `Aspnet_compiler.exe` to run the final infostealer. Researchers tied the activity to the PhantomStealer malware-as-a-service ecosystem advertised via `phantomsoftwares.site` and the Telegram identity **Oldphantomoftheopera**, with builder-generated samples showing per-build customization but a stable framework, anti-analysis logic, and optional persistence. The payloads stole browser credentials, cookies, credit cards, email and messaging data, Wi-Fi passwords, screenshots, keystrokes, and cryptocurrency wallet information, while some builds also enabled a crypto clipper that replaced wallet addresses across multiple chains. The campaigns abused legitimate but compromised infrastructure for both delivery and exfiltration, including a Portuguese theater website hosting encrypted PowerShell stages, a Chilean mail server and a Malaysian business email account used as SMTP relays, and Romanian FTP hosting used by another PhantomStealer build. Exfiltration varied by sample—SMTP to attacker mailboxes at `graceishere.tech`, Telegram Bot API, Discord, or FTP—but infrastructure overlap repeatedly linked the deployments back to the same MaaS operation, and one report also connected a PhantomStealer FTP campaign to related AgentTesla activity through shared submissions and tooling. The targeting and lure themes indicate a focus on procurement, shipping, maritime, industrial, and accounts receivable personnel, while the repeated use of compromised SMB hosting and mail systems suggests operators favored hijacked third-party services over dedicated attacker-owned infrastructure.
Jun 29, 2026