Kaspersky researchers analyze a C++ and Python stealer dubbed “Arkanix Stealer”, which was active for several months, targeted wide range of data, was distributed as MaaS and offered referral program to its partners.

Securelist is a cybersecurity blog and research platform operated by Kaspersky Lab. It offers insights, analysis, and reports on cybersecurity threats, vulnerabilities, and malware campaigns. Developers can learn about emerging cyber threats, security best practices, and mitigation strategies to protect their applications and systems. Additionally, Securelist provides insights into cybersecurity trends, threat intelligence, and industry developments, offering resources for cybersecurity professionals.

Securelist

Kaspersky researchers detail Arkanix Stealer, a short-lived MaaS infostealer discovered in October 2025 that operated until around December 2025. It came in two implementations: a C++ native version using VMProtect and the ChromElevator browser post-exploitation tool, and a Python version with dynamically configurable features. Both versions targeted a broad range of data including browser credentials, cookies, cryptocurrency wallets, Telegram sessions, Discord accounts, VPN credentials, gaming platform logins, and files. The stealer was distributed via phishing using decoy filenames, registered victims on a control panel, and exfiltrated data encrypted with AES-GCM + PBKDF2. The campaign featured a referral program and Discord-based community marketing. Code patterns suggest LLM-assisted development by a German-speaking author. The panel and affiliate program were taken down without notice, suggesting a one-shot financial campaign.

Arkanix Stealer targets a variety of data, offers a MaaS referral program