Kaspersky Details Arkanix Stealer as Its Operations Appear to End
Summary
Kaspersky says Arkanix Stealer, a C++ and Python infostealer advertised as a service in October 2025, collected credentials and files and could spread through Discord. Its control panel and Discord channel disappeared around December.
Key points
- Kaspersky says Arkanix Stealer emerged in October 2025 as a malware-as-a-service offering and likely ceased operations after its control panel and Discord channel disappeared around December.
- The C++ and Python variants could collect system details, browser data, credentials, VPN information, and files from specified user directories.
- The Python variant could modify its configuration through GET requests to a remote server and was often packaged with PyInstaller or Nuitka.
- An analyzed sample used the Discord API to collect a victim’s friends and channels, then send them a configured message.
- The malware could ZIP selected files for exfiltration and fetch additional modules from its command-and-control server.
- The native variant also used VMProtect, captured screenshots, collected RDP connection details, and targeted gaming files and clients for credentials.
Article Details
- Attack Vectors
- The Python variant was deployed via a Python script, often bundled with PyInstaller or Nuitka.
- The malware collected browser data, including passwords and cookies, and credentials from VPN clients.
- It used the Discord API to obtain a victim’s friends and channels, then sent them a configured message.
- It collected files from predefined user-directory paths, packed them into a ZIP archive, and sent them to its command-and-control server.
- It could fetch additional modules from its command-and-control server and place a Python script in the startup folder for execution at boot.
MITRE ATT&CK
T1005 · Data from Local SystemIt collected files from predefined directories associated with the current user.T1041 · Exfiltration Over C2 ChannelIt sent collected files to its C&C server.T1071.001 · Web ProtocolsThe Python variant made GET requests to a remote server to dynamically modify its configuration.T1082 · System Information DiscoveryThe malware collected system information, including CPU, GPU, RAM, operating system, and screen details.T1105 · Ingress Tool TransferIt fetched additional modules from its C&C server.T1113 · Screen CaptureThe native variant captured screenshots.T1518 · Software DiscoveryIt collected details about installed software, including antivirus and VPN applications.T1539 · Steal Web Session CookieThe malware collected browser cookies.T1547.001 · Registry Run Keys / Startup FolderAn additional Python script was placed in the startup folder to execute at system boot.T1555.003 · Credentials from Web BrowsersArkanix Stealer harvested passwords and other data from browsers.T1560.001 · Archive via UtilityIt packed collected files into a ZIP archive before sending them to its C&C server.
Malware
Products
Discordit in underground forum posts, but likely ceased operations in December, when its control panel and Discord channel disappeared.ExpressVPNKaspersky also observed the malware collecting credentials from known VPN clients, such as Mullvad VPN, NordVPN, ExpressVPN, and ProtonVPN.Google ChromeThese modules include a Chrome grabber, a wallet patcher, an extra collector, and a Python script placed in the startup folder to be executed at system boot.Mullvad VPNKaspersky also observed the malware collecting credentials from known VPN clients, such as Mullvad VPN, NordVPN, ExpressVPN, and ProtonVPN.NordVPNKaspersky also observed the malware collecting credentials from known VPN clients, such as Mullvad VPN, NordVPN, ExpressVPN, and ProtonVPN.Proton VPNKaspersky also observed the malware collecting credentials from known VPN clients, such as Mullvad VPN, NordVPN, ExpressVPN, and ProtonVPN.Telegramcapabilities, collecting system and user information, application details, browser data, Telegram and Discord data, VPN information, and stealing files from specific directories.