Loading story…
Analysis of a malicious Windows Installer (.msi) sample linked the payload to the Arkei stealer family after the installer unpacked an embedded executable from a CAB stream and executed a packed binary. The sample was reportedly built with MSI Wrapper 10.0.50.0 and dropped an executable named NEnXoxoXxKaPjctW.exe, which was protected with Obsidium, limiting static analysis and pushing investigators toward sandbox-based telemetry for identification.
Sandbox and forensic evidence showed the malware collecting browser data and exfiltrating a ZIP archive containing files such as screenshot.jpg, system.txt, and Firefox history artifacts, behavior consistent with information-stealing malware focused on browsers and cryptocurrency wallets. Researchers noted overlap with Vidar, Oski, and possibly Mars-like tradecraft, underscoring how closely related stealer families can blur attribution even when telemetry strongly suggests Arkei activity.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
Based on the uploaded archive contents and behavioral overlap, the analyst concluded the sample shared traits with Arkei, Vidar, Oski, and possibly Mars, making precise family attribution difficult. The overlap included screenshot and system information collection as well as Firefox history theft.
After finding the embedded executable was packed with Obsidium, the analyst relied on sandbox telemetry, where a Tria.ge report found Arkei evidence in memory for the payload process. Network telemetry also showed the malware downloading browser-related DLLs and exfiltrating a ZIP archive containing stolen data.
Tony Lambert analyzed a malicious MSI installer sample from MalwareBazaar on Linux using msitools, extracting an embedded executable from the MSI's CAB stream. The sample's metadata indicated it was built with MSI Wrapper 10.0.50.0 from EXEMSI.COM.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Arkanix Stealer** emerged as a previously undocumented infostealer offered under a **malware-as-a-service (MaaS)** model, promoted via dark web forum advertisements that directed buyers to a Discord server for coordination. Analysis identified multiple implants, including a native **C++** variant with broad data-theft capabilities (e.g., system profiling and **cryptocurrency wallet** theft) and a **Python** implementation that can dynamically modify its configuration and is often packed to hinder analysis. The toolset also incorporated *ChromElevator*, a publicly available browser post-exploitation utility, and detections were mapped to families such as `Trojan-PSW.Win64.Coins.*` and `Trojan.Python.Agent.*`; the associated affiliate/referral program appeared to have been taken down, suggesting a short-lived operation. Separately, January 2026 telemetry and case analysis on infostealer distribution highlighted ongoing, high-volume delivery via **crack/keygen camouflage** and **SEO poisoning**, with prominent families including **LummaC2**, **Vidar**, and **ACRStealer**. The reporting emphasized automated collection and analysis pipelines that extract C2/IOC data and support near-real-time blocking via an indicator service, underscoring that infostealer operations continue to rely on scalable distribution and obfuscation techniques even as individual MaaS offerings like Arkanix may be transient.
Jun 29, 2026
Researchers documented several **multi-stage malware campaigns** that used phishing lures, fake software updates, and DLL sideloading to deploy credential theft and remote access payloads. In one June 2026 intrusion targeting a small number of German financial institutions, a spear-phishing email posing as an urgent VPN update delivered a 7-Zip self-extracting archive that dropped a signed copy of **Radmin VPN** alongside a trojanized `Qt5Core.dll`, launching **HijackLoader** and ultimately **Vidar v2.1** through process hollowing into a signed `dBpoweramp` binary. A parallel chain used Opera sideloading to install **SnappyClient RAT**. Separate reporting also described a targeted Spanish-language phishing lure that delivered a password-protected archive containing a .NET loader and a byte-reversed DLL payload, as well as a fake browser update chain that used a signed **G DATA AntiVirus** binary to sideload **PlugX** linked to suspected **Mustang Panda** activity. Across the cases, the malware families showed strong emphasis on **credential theft, stealth, and layered execution**. Vidar samples were observed harvesting browser passwords, cookies, screenshots, FileZilla and WinSCP data, and cryptocurrency wallet information, while also bypassing Chromium App-Bound Encryption by launching legitimate Chrome and Edge instances with specific flags and using dead-drop resolvers such as **Steam** and **Telegram** to locate command-and-control servers. The PlugX implant used multiple decoding and encryption layers, manual PE mapping, registry-based persistence, and WinHTTP communications to `fruitbrat[.]com:443`, while another credential-stealing sample tied in open sources to **RedFoxtrot** targeted Firefox and Internet Explorer data and used proxy-aware HTTP communications with hardcoded infrastructure. The reporting highlights continued attacker reliance on signed binaries, staged loaders, and obfuscated payload handling to evade detection while stealing credentials and enabling follow-on access.
Jul 12, 2026
Researchers analyzing multiple **Vidar Stealer** samples found the malware relies heavily on encrypted or XOR-obfuscated strings and dynamic API resolution to conceal its behavior. Reverse engineering with **Ghidra** and **x32dbg** exposed decrypted strings tied to `LoadLibraryA`, `GetProcAddress`, `VirtualAlloc`, anti-analysis checks, and broad data-theft functions. The recovered functionality shows Vidar harvesting browser passwords, cookies, autofill data, credit cards, Firefox/NSS secrets, FileZilla and WinSCP data, Steam files, Discord and Telegram artifacts, screenshots, host metadata, and numerous desktop and browser-extension cryptocurrency wallets. A separate campaign analysis showed Vidar configured to treat some stolen data differently when credentials were associated with hostnames linked to government, military, police, intelligence, CERT, and NATO-related organizations in Poland and the Baltic region. In that sample, the malware decrypted a hardcoded hostname list, checked stolen credentials for matches, and redirected matching data to an alternate command-and-control path, while command-and-control addresses were retrieved from Mastodon profiles including **@oleg98** and **@artemida**. The reporting also linked the broader activity to infrastructure or samples associated with **Raccoon**, **RedLine Stealer**, **SmokeLoader**, and **STOP ransomware**, indicating a wider criminal ecosystem around the campaign.
Aug 15, 2026