Loading malware…
Arkei is a Windows information-stealing malware family active since at least 2018. It is best known as an early commodity stealer whose codebase influenced multiple later families, most notably Vidar, and is frequently referenced as the ancestor or source lineage for other Arkei-derived stealers such as Oski and Mars. Arkei is commonly characterized as a password and browser-data stealer rather than a general-purpose remote access tool.
Arkei targets stored data on infected Windows systems, especially credentials and other sensitive information held by web browsers. Reported behavior associated with Arkei-family samples includes theft of browser-stored passwords and related data, use of SQLite-backed browser stores, and retrieval of legitimate browser-support libraries to access or decrypt protected data from Chromium- and Mozilla-based applications. Arkei-family infections have also been associated with collection and exfiltration of stolen data in archive form.
Arkei has appeared both as a standalone stealer and as a payload delivered by other malware. It has been observed distributed by the Retadup worm, and reporting on related stealer ecosystems shows it can be delivered through malicious installer chains and other commodity-malware distribution workflows. Public reporting does not establish a single definitive threat actor attribution for Arkei itself, but the family is closely associated with the broader cybercriminal infostealer market and with code reuse across multiple malware operations.
Arkei is significant less for publicized large-scale branded campaigns than for its role as a foundational stealer family whose source code and design patterns were reused in successor malware. Its legacy is most visible in the evolution of later MaaS-oriented infostealers that expanded on Arkei’s credential-theft and browser-data collection model.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
rule win_arkei_stealer_auto { ... description = "Detects win.arkei_stealer." ... malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.arkei_stealer" ... } ... rule win_arkei_stealer_w0 { ... description = "Arkei Stealer" ... $s1 = "Arkei" ... $s2 = "/server/gate" ... $s3 = "/server/grubConfig" ... $s4 = "\\files\\" ... $s5 = "SQLite" ... }
11 distinct techniques documented for this family, organized by ATT&CK tactic.
These DLLs are commonly downloaded and loaded into memory by stealers as they provide functionality to decrypt sensitive data within Mozilla Firefox and Chromium-based web browsers.
5 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
21 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Older stealer malware whose source code was used to develop Vidar.
Credential-stealing malware framework referenced as the basis from which Vidar originally developed.
Arkei is referenced only as the credential-stealer base from which Vidar originally evolved.
Referenced as the stealer family from which Vidar originated as a fork.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.