Arkanix Stealer: Newly discovered short term profit malware
Essential information
- Published
- 01/12/2025 19:55
- Modified
- 21/12/2025 18:18
- Tags
- 2025-12-01 arkanix arkanix stealer browser data c++ chrome elevator crypto wallets discord infostealer python vmprotect
- Related entities
- 2 observables, 25 techniques (mitre), 1 others
Description
A new information stealer named Arkanix has emerged, likely designed for short-term financial gains. Advertised on Discord, it has rapidly evolved from a Python-based to a C++ version. The malware steals data from various browsers, crypto wallets, VPN accounts, and system information. It employs sophisticated techniques like VMProtect for obfuscation and 'Chrome Elevator' to bypass App Bound Encryption. Arkanix is distributed through Discord and online forums, disguised as legitimate tools. The threat actors offer a web panel with premium features, including VPN and Steam account theft. This case highlights the ease of starting cybercrime businesses for quick profits, with actors demonstrating considerable experience in malware development and distribution.