Threat reportMalwareTL-2026-3768
Arkanix Stealer: short-lived MaaS infostealer (Python/Nuitka loader and C++ Premium variants with ChromElevator ABE bypass)
Arkanix Stealer (TL-2026-3768), also tracked as Arkanix, is a medium-severity malware campaign, first published 2026-10-16. It has no confirmed attribution, affects Microsoft Windows, maps to 23 MITRE ATT&CK techniques (T1005, T1016.002, T1027.002), and is covered by 9 detection rules and 26 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 23MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 26Indicators of compromise
Key facts for TL-2026-3768
- Threat ID
- TL-2026-3768
- Also known as
- Arkanix, ArkanixStealer
- Severity
- MEDIUM
- Status
- MONITORING
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- consumer, gaming, cryptocurrency, finance
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 26
Malware and tooling in Arkanix Stealer
Malware and tooling: Arkanix Stealer, Exodus - S0405, Python, telegram, ChromElevator
How Arkanix Stealer works
Arkanix is a malware-as-a-service infostealer sold via Discord and underground forums in late 2025, in a Python (Nuitka/PyInstaller-packaged loader) edition and a native C++ 'Premium' edition. The C++ build embeds ChromElevator to bypass Chrome App-Bound Encryption and steals browser data, crypto wallets, VPN, Discord, Telegram, Steam and Wi-Fi/RDP credentials; the operation was taken down in December 2025.
Arkanix Stealer was first reported by Kaspersky GReAT (forum advertisements observed October 2025) and analyzed by G DATA (published 2025-12-01) and Dexpose (2025-12-22). It was operated as malware-as-a-service: affiliates registered on a web panel at arkanix.pw/login using an invite code distributed through the operators' Discord server, with a referral program (referrers earned 1 free premium hour, invitees a 7-day free premium trial). The Premium tier added the C++ native stealer, Exodus/Atomic wallet injection, up to 10 payload builds, VPN/Steam/screenshot/Wi-Fi theft and priority support. Kaspersky and G DATA describe the family as a short-term, quick-profit campaign, and Kaspersky noted probable traces of LLM-assisted development (utils.cpp structure, extensive comments, debug output).
Python edition: loaders packaged with PyInstaller or Nuitka (G DATA observed a loader.dll hosting the compiled bytecode as a resource) pip-install requests, pycryptodome, psutil and pywin32, POST to arkanix.pw/api/session/create to obtain a session token, then fetch and execute stealer.py from memory. Behavior is configured dynamically through GET /api/features/{payload_id} (collect_filezilla, collect_vpn_data, collect_steam, collect_screenshots, telegram_optimized, Discord self-spreading). Additional modules are pulled from the panel (upload_dropper.py, chrome-grabber-template, wallet-patcher, extra-collector, hvnc); an HVNC module is saved to the user's Startup folder as hvnc.py. Collected data is serialized to %LOCALAPPDATA%\Arkanix_lol\<info_class>.json, uploaded to /delivery, and artifacts are self-removed.
C++ Premium edition: protected with VMProtect (without virtualization), patches AmsiScanBuffer and EtwEventWrite, and performs extensive anti-analysis (IsDebuggerPresent/CheckRemoteDebuggerPresent, minimum 2 CPU cores/2 GB RAM, VM registry artifacts, a blacklist of analysis tools such as procmon, wireshark, x64dbg, ida, ghidra, dnspy, ollydbg, windbg, hostname/username blacklists, and GetTickCount64 sleep-skip checks). It embeds ChromElevator as a PE resource, drops it to %TEMP% (e.g. cl_<random>.exe) and runs it against each Chromium browser (60-second timeout) using reflective process hollowing/injection to defeat Chrome App-Bound Encryption (v127+). It targets 22-23+ Chromium-based browsers, crypto-wallet/password-manager/2FA extensions, Discord client variants (LevelDB token scanning), Telegram tdata, Steam/Epic/Battle.net/Riot/Ubisoft/GOG, VPN clients (Mullvad, NordVPN, ExpressVPN, ProtonVPN), FileZilla, RDP files (full address, username, password 51:b: decrypted via CryptUnprotectData), Wi-Fi profiles (WLAN APIs/netsh, DPAPI-decrypted keys), keyword-filtered documents and screenshots. Data is staged under C:\ArkanixData\ and %TEMP%\arkanix_data.zip, encrypted with AES-GCM + PBKDF2 and uploaded by HTTP POST to /api/upload/direct with headers X-Payload-ID, X-User-ID, X-Timestamp and an HMAC-SHA256 X-Signature, using the User-Agent ArkanixStealer/1.0 or /2.0 depending on build (G DATA/Dexpose reported 2.0, Kaspersky 1.0).
Infrastructure: arkanix.pw (first seen 2025-10-09) resolved behind Cloudflare, with origin IPs 195.246.231.60 (Python Waitress panel on port 5000) and 93.95.226.152 hosted at 1984 Hosting (AS44925, Iceland); arkanix.ru (first seen 2025-10-19) also sat behind Cloudflare. The panel and Discord server were taken down in December 2025, and the domain was offline at the time of G DATA's analysis. No CVE, no named threat actor and no victimology were reported in the sources; the infection vector is described as phishing/Discord-themed lures and trojanized 'legitimate tools'. Defenders should still hunt for the artifacts because the code, builds and ChromElevator technique may be reused by successors.
MITRE ATT&CK techniques used in TL-2026-3768
Collection
T1005 Data from Local System; T1074.001 Local Data Staging; T1113 Screen Capture; T1560.002 Archive via Library
Discovery
T1016.002 Wi-Fi Discovery; T1082 System Information Discovery; T1518.001 Security Software Discovery
Defense Evasion
T1027.002 Software Packing; T1055.012 Process Hollowing; T1070.004 File Deletion; T1497.001 System Checks; T1497.003 Time Based Checks; T1622 Debugger Evasion
Execution
T1059.006 Python; T1204.002 Malicious File
Command and Control
T1071.001 Web Protocols; T1573.001 Symmetric Cryptography
Credential Access
T1528 Steal Application Access Token; T1539 Steal Web Session Cookie; T1552.001 Credentials In Files; T1555.003 Credentials from Web Browsers
Persistence
T1547.001 Registry Run Keys / Startup Folder
defense-impairment
Affected products and versions in Arkanix Stealer
- Microsoft — Windows
Vulnerable versions: Windows endpoints running unprotected user sessions - Google / Chromium-based browsers — Chrome, Edge, Brave, Opera, Vivaldi, Yandex and other Chromium browsers (App-Bound Encryption v127+ bypassed)
Vulnerable versions: Chromium-based browsers storing credentials/cookies
Remediation for Arkanix Stealer
Patches
- No CVE; keep Chrome and other Chromium browsers updated (App-Bound Encryption v127+ is bypassed post-compromise, not patched)
Immediate actions
- Block arkanix.pw and arkanix.ru at DNS/proxy and egress-filter 195.246.231.60 and 93.95.226.152
- Hunt for %LOCALAPPDATA%\Arkanix_lol, C:\ArkanixData, %TEMP%\arkanix_data.zip and %TEMP%\cl_*.exe artifacts and the ArkanixStealer/1.0 and /2.0 User-Agents
- Reset passwords, revoke sessions/tokens (browser cookies, Discord, Telegram, Steam) and rotate VPN, RDP and Wi-Fi credentials on any host where indicators are found
- Move crypto-wallet seed phrases/funds from any potentially exposed wallet
Workarounds
- Disable password storage in browsers via policy and use a managed password manager
- Block outbound traffic to newly registered .pw/.ru domains where not business-required
Longer-term hardening
- Deploy EDR with detection for AMSI/ETW patching, process hollowing into browsers and Python-based loaders
- Restrict Python/pip execution and unsigned executables on endpoints; block Discord CDN-delivered executables
- Enforce hardware-backed MFA/passkeys so stolen cookies and passwords have limited value
- Train users on fake 'tools', cracks and Discord-delivered files
Timeline of Arkanix Stealer
- Kaspersky observed forum advertisements for the Arkanix MaaS in October 2025; Discord server used for sales, invite codes and updates (month precision only; day not stated in sources)
- C2/panel domain arkanix.pw first seen (per Kaspersky GReAT)
- Secondary domain arkanix.ru first seen, fronted by Cloudflare
- Panel and Discord server taken down in December 2025 (Kaspersky); affiliate program no longer available (month precision only; day not stated in sources)
- G DATA publishes analysis of Arkanix Python and C++ Premium variants, noting rapid evolution and the ChromElevator ABE bypass; arkanix.pw offline at time of analysis
- Dexpose publishes infrastructure deep dive identifying origin IPs 195.246.231.60 and 93.95.226.152 (AS44925, 1984 Hosting) and detailed anti-analysis/exfiltration protocol
Sources cited for Arkanix Stealer
- G DATA: Arkanix Stealer: Newly discovered short term profit malware
- Kaspersky GReAT: Arkanix Stealer (Securelist)
- Dexpose: Deep Dive into Arkanix Stealer and its Infrastructure
- Security Affairs: Arkanix Stealer: AI-assisted info-stealer shuts down after brief campaign
- Hive Pro: Arkanix Stealer threat advisory TA2025369
- MalwareTips: Arkanix Stealer: a C++ & Python infostealer
Detection coverage for TL-2026-3768
As of 2026-10-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3768 across Splunk SPL, Microsoft KQL and Sigma, covering 26 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-3768
8 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.