Kaspersky Finds Signs Arkanix Stealer Was an LLM-Assisted Experiment
Summary
Kaspersky researchers analyzed Arkanix Stealer, a short-lived information-stealing operation with Python and C++ versions, broad data-theft capabilities and signs of possible LLM-assisted development. Its operator shut down the project about two months after launch.
Key points
- Arkanix was promoted in October 2025 with a Python-based basic tier and a C++ premium tier protected by VMProtect.
- The stealer could collect browser history, autofill data, cookies, passwords, OAuth2 tokens and cryptocurrency wallet data.
- Additional capabilities included stealing RDP credentials, capturing screens, targeting gaming platforms and using HVNC.
- The premium version included ChromElevator, which Kaspersky said was designed to bypass Google App-Bound Encryption by injecting into suspended browser processes.
- Kaspersky researchers found coding clues consistent with LLM-assisted development, but the article describes this as an indication rather than a confirmed development method.
- The operator removed the control panel and Discord server about two months after the project began; Kaspersky published indicators of compromise.
Article Details
- Event Type
- Kaspersky researchers analyzed Arkanix Stealer, a short-lived information-stealing malware operation promoted in late 2025. They found coding traces consistent with LLM-assisted development.
- Impact
- The malware was described as capable of stealing browser data, credentials, OAuth2 tokens, cryptocurrency wallet data, and files, as well as targeting messaging, gaming, and VPN products. Its premium variant adds RDP credential theft, screen capture, and injection into suspended browser processes. The article reports these capabilities but does not identify specific victims or confirmed incidents of data theft.
MITRE ATT&CK
T1005 · Data from Local SystemArkanix can collect system information and archive files from the local filesystem.T1055 · Process InjectionChromElevator injects into suspended browser processes for data theft.T1105 · Ingress Tool TransferAdditional Arkanix modules can be downloaded from its command-and-control.T1113 · Screen CaptureThe premium variant includes screen-capturing capability.T1497 · Virtualization/Sandbox EvasionThe premium variant includes anti-sandbox checks.T1528 · Steal Application Access TokenArkanix can extract OAuth2 tokens from Chromium-based browsers.T1539 · Steal Web Session CookieArkanix can steal browser cookies.T1555.003 · Credentials from Web BrowsersArkanix can steal passwords and other data stored in browsers.T1622 · Debugger EvasionThe premium variant includes anti-debugging checks.
Malware
Products
AtomicAdditional modules that can be downloaded from the command-and-control include a Chrome grabber, a wallet patcher for Exodus or Atomic, a screenshots tool, HVNC, and stealers for FileZilla and Steam.DiscordKaspersky researchers found indicators of LLMâassisted development, a shortâlived Discord community and referral program, and published IoCs while the operator abruptly took down the project two months after launch.ExodusAdditional modules that can be downloaded from the command-and-control include a Chrome grabber, a wallet patcher for Exodus or Atomic, a screenshots tool, HVNC, and stealers for FileZilla and Steam.ExpressVPNArkanix also targets credentials for Mullvad, NordVPN, ExpressVPN, and ProtonVPN, and can archive files from the local filesystem to exfiltrate them asynchronously.FileZillaAdditional modules that can be downloaded from the command-and-control include a Chrome grabber, a wallet patcher for Exodus or Atomic, a screenshots tool, HVNC, and stealers for FileZilla and Steam.MullvadArkanix also targets credentials for Mullvad, NordVPN, ExpressVPN, and ProtonVPN, and can archive files from the local filesystem to exfiltrate them asynchronously.NordVPNArkanix also targets credentials for Mullvad, NordVPN, ExpressVPN, and ProtonVPN, and can archive files from the local filesystem to exfiltrate them asynchronously.Proton VPNArkanix also targets credentials for Mullvad, NordVPN, ExpressVPN, and ProtonVPN, and can archive files from the local filesystem to exfiltrate them asynchronously.SteamAdditional modules that can be downloaded from the command-and-control include a Chrome grabber, a wallet patcher for Exodus or Atomic, a screenshots tool, HVNC, and stealers for FileZilla and Steam.TelegramAdditionally, the malware can steal data from Telegram, steal Discord credentials, spread via the Discord API, and send messages to the victim’s friends/channels.
Tools
ChromElevatorThe higher-tier variant also delivers the ChromElevator post-exploitation tool, which injects into suspended browser processes for data theft and is designed to bypass Google’s App-Bound Encryption (ABE) protection forVMProtectoperation promoted on dark web forums in late 2025, offered modular Python and premium C++ builds with VMProtect and extensive dataâtheft capabilities across browsers, wallets, messengers, and gaming platforms.