# Arkanix Stealer: short-lived MaaS infostealer (Python/Nuitka loader and C++ Premium variants with ChromElevator ABE bypass)

> Arkanix is a malware-as-a-service infostealer sold via Discord and underground forums in late 2025, in a Python (Nuitka/PyInstaller-packaged loader) edition and a native C++ 'Premium' edition. The C++ build embeds ChromElevator to bypass Chrome App-Bound Encryption and steals browser data, crypto wallets, VPN, Discord, Telegram, Steam and Wi-Fi/RDP credentials; the operation was taken down in December 2025.

- **Published:** 2026-10-16T19:08:10Z
- **Last reviewed:** 2026-10-16T19:08:10Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3768
- **ID:** TL-2026-3768
- **Severity:** MEDIUM
- **Category:** MALWARE
- **Status:** MONITORING
- **Detections:** 9 · **IOCs:** 26 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Arkanix Stealer was first reported by Kaspersky GReAT (forum advertisements observed October 2025) and analyzed by G DATA (published 2025-12-01) and Dexpose (2025-12-22). It was operated as malware-as-a-service: affiliates registered on a web panel at arkanix.pw/login using an invite code distributed through the operators' Discord server, with a referral program (referrers earned 1 free premium hour, invitees a 7-day free premium trial). The Premium tier added the C++ native stealer, Exodus/Atomic wallet injection, up to 10 payload builds, VPN/Steam/screenshot/Wi-Fi theft and priority support. Kaspersky and G DATA describe the family as a short-term, quick-profit campaign, and Kaspersky noted probable traces of LLM-assisted development (utils.cpp structure, extensive comments, debug output).

Python edition: loaders packaged with PyInstaller or Nuitka (G DATA observed a loader.dll hosting the compiled bytecode as a resource) pip-install requests, pycryptodome, psutil and pywin32, POST to arkanix.pw/api/session/create to obtain a session token, then fetch and execute stealer.py from memory. Behavior is configured dynamically through GET /api/features/{payload_id} (collect_filezilla, collect_vpn_data, collect_steam, collect_screenshots, telegram_optimized, Discord self-spreading). Additional modules are pulled from the panel (upload_dropper.py, chrome-grabber-template, wallet-patcher, extra-collector, hvnc); an HVNC module is saved to the user's Startup folder as hvnc.py. Collected data is serialized to %LOCALAPPDATA%\Arkanix_lol\<info_class>.json, uploaded to /delivery, and artifacts are self-removed.

C++ Premium edition: protected with VMProtect (without virtualization), patches AmsiScanBuffer and EtwEventWrite, and performs extensive anti-analysis (IsDebuggerPresent/CheckRemoteDebuggerPresent, minimum 2 CPU cores/2 GB RAM, VM registry artifacts, a blacklist of analysis tools such as procmon, wireshark, x64dbg, ida, ghidra, dnspy, ollydbg, windbg, hostname/username blacklists, and GetTickCount64 sleep-skip checks). It embeds ChromElevator as a PE resource, drops it to %TEMP% (e.g. cl_<random>.exe) and runs it against each Chromium browser (60-second timeout) using reflective process hollowing/injection to defeat Chrome App-Bound Encryption (v127+). It targets 22-23+ Chromium-based browsers, crypto-wallet/password-manager/2FA extensions, Discord client variants (LevelDB token scanning), Telegram tdata, Steam/Epic/Battle.net/Riot/Ubisoft/GOG, VPN clients (Mullvad, NordVPN, ExpressVPN, ProtonVPN), FileZilla, RDP files (full address, username, password 51:b: decrypted via CryptUnprotectData), Wi-Fi profiles (WLAN APIs/netsh, DPAPI-decrypted keys), keyword-filtered documents and screenshots. Data is staged under C:\ArkanixData\ and %TEMP%\arkanix_data.zip, encrypted with AES-GCM + PBKDF2 and uploaded by HTTP POST to /api/upload/direct with headers X-Payload-ID, X-User-ID, X-Timestamp and an HMAC-SHA256 X-Signature, using the User-Agent ArkanixStealer/1.0 or /2.0 depending on build (G DATA/Dexpose reported 2.0, Kaspersky 1.0).

Infrastructure: arkanix.pw (first seen 2025-10-09) resolved behind Cloudflare, with origin IPs 195.246.231.60 (Python Waitress panel on port 5000) and 93.95.226.152 hosted at 1984 Hosting (AS44925, Iceland); arkanix.ru (first seen 2025-10-19) also sat behind Cloudflare. The panel and Discord server were taken down in December 2025, and the domain was offline at the time of G DATA's analysis. No CVE, no named threat actor and no victimology were reported in the sources; the infection vector is described as phishing/Discord-themed lures and trojanized 'legitimate tools'. Defenders should still hunt for the artifacts because the code, builds and ChromElevator technique may be reused by successors.

## MITRE ATT&CK

- T1204.002 Malicious File
- T1059.006 Python
- T1547.001 Registry Run Keys / Startup Folder
- T1027.002 Software Packing
- T1685 Disable or Modify Tools
- T1055.012 Process Hollowing
- T1497.001 System Checks
- T1497.003 Time Based Checks
- T1622 Debugger Evasion
- T1070.004 File Deletion
- T1555.003 Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1528 Steal Application Access Token
- T1552.001 Credentials In Files
- T1082 System Information Discovery
- T1518.001 Security Software Discovery
- T1016.002 Wi-Fi Discovery
- T1113 Screen Capture
- T1005 Data from Local System
- T1074.001 Local Data Staging
- T1560.002 Archive via Library
- T1071.001 Web Protocols
- T1573.001 Symmetric Cryptography

## Sources

- [G DATA: Arkanix Stealer: Newly discovered short term profit malware](https://blog.gdatasoftware.com/2025/12/38306-arkanix-stealer)
- [Kaspersky GReAT: Arkanix Stealer (Securelist)](https://securelist.com/arkanix-stealer/119006/)
- [Dexpose: Deep Dive into Arkanix Stealer and its Infrastructure](https://www.dexpose.io/deep-dive-into-arkanix-stealer-and-its-infrastructure/)
- [Security Affairs: Arkanix Stealer: AI-assisted info-stealer shuts down after brief campaign](https://securityaffairs.com/188431/malware/arkanix-stealer-ai-assisted-info-stealer-shuts-down-after-brief-campaign.html)
- [Hive Pro: Arkanix Stealer threat advisory TA2025369](https://hivepro.com/wp-content/uploads/2025/12/TA2025369.pdf)
- [MalwareTips: Arkanix Stealer: a C++ & Python infostealer](https://malwaretips.com/threads/arkanix-stealer-a-c-python-infostealer.139819/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3768