Arkanix Stealer: Brief AI-Driven Info-Stealer Experiment Emerges
Arkanix Stealer: A Short-Lived Experiment in AI-Assisted Malware Development
A recently discovered information-stealing malware operation, dubbed Arkanix Stealer, appears to have been a short-lived experiment in leveraging artificial intelligence (AI) to facilitate malware development. The operation, which was promoted on multiple dark web forums in late 2025, offered a range of features typical of data-stealing malware, including a modular architecture and anti-analysis capabilities.
Development and Features
Researchers at Kaspersky analyzed the Arkanix Stealer and found evidence suggesting that the malware was developed with the assistance of large language models (LLMs). This approach may have significantly reduced development time and costs, allowing the authors to quickly deploy the malware and capitalize on potential financial gains.
The Arkanix Stealer operation began in October 2025, with the authors promoting the malware on hacker forums and offering two tiers of service: a basic Python-based implementation and a premium native C++ payload with additional features such as VMProtect protection, AV evasion, and wallet injection. The authors also established a Discord server to communicate with users, provide updates, and solicit feedback.
Capabilities and Targets
The malware is capable of collecting system information, stealing data stored in browsers, and extracting cryptocurrency wallet data from 22 browsers. It can also steal data from Telegram and Discord, spread via the Discord API, and send messages to the victim’s friends and channels. Additionally, the malware targets credentials for several VPN providers and can archive files from the local filesystem for exfiltration.
The premium version of the malware includes additional features such as RDP credential theft, anti-sandbox and anti-debugging checks, and screen capturing via WinAPI. It also targets several gaming platforms and delivers the ChromElevator post-exploitation tool, which is designed to bypass Google’s App-Bound Encryption (ABE) protection.
Conclusion and Implications
The purpose of the Arkanix Stealer experiment is unclear, but it may be an attempt to determine the feasibility of using LLM-assisted development to improve malware development and deployment. Kaspersky researchers have provided a comprehensive list of indicators of compromise (IoCs) that include hashes for detected files, domains, and IP addresses.
The Arkanix Stealer operation highlights the evolving nature of malware development and the increasing use of AI and other advanced technologies to facilitate cybercrime. As the threat landscape continues to shift, it is essential for organizations to remain vigilant and proactive in their cybersecurity efforts.
About Author
English