New Arkanix infostealer discovered

Newly emergent Arkanix information-stealing malware has been under accelerated development to facilitate extensive data theft for financially motivated threat actors, according to GBHackers News.

Highly convincing fraudulent tools on Discord have been leveraged to spread Arkanix, which is available in Python-based and C++-based variants, a report from G DATA showed. Aside from stealing data from multiple Chromium-based browsers and cryptocurrency wallet applications, Arkanix also pilfers Wi-Fi credentials, VPN account information, and exhaustive system details that could be harnessed for targeted intrusions.

Moreover, Arkanix's more sophisticated C++ version enables Remote Desktop Protocol credential extraction for lateral movement, while exploiting the Chrome Elevator post-exploitation tool to bypass Google Chrome's App Bound Encryption defenses. All payloads were also discovered to include VMProtect obfuscation.

The threat of Arkanix should prompt increased vigilance on Discord downloads, the utilization of encryption-focused password managers, and the adoption of endpoint detection and response solutions.