Skip to main content
IOC Radar

Indicators are what attackers leave behind. Stolen credentials are what they arrive with.

Check Exposure
6 IOCs

Deep Dive into Arkanix Stealer and its Infrastructure

DeXpose
DeXpose
Published December 22, 2025Original Report

Threat Actors

Excerpt

Arkanix Stealer is an actively developed credential‑theft malware family that is primarily advertised on Discord, where its operators have been promoting rapid updates and new feature additions. While the initial release of Arkanix was written in Python, the threat actors have since expanded its capabilities by implementing a C++ variant, marketed as a “Premium” edition. Distribution for both versions appears to rely on Discord, where the malware is shared under the guise of…

Read the original report →

Diamond Model

SOCIAL AXISTECHNOLOGY AXISADVERSARYSandwormINFRASTRUCTURE195.246.231.60https://arkanix.pw/ap…93.95.226.152CAPABILITYunknownVICTIMunknown
Adversary(1)
Infrastructure(3)
Capability
Victim

Indicators of Compromise

Open the mindmap →

6 indicators

TypeIndicatorConfidenceScoreFirst Seen
SHA256f7d53884a35e5f5149ac4d4d2a2de75b15283edd43ec891e9eae05d194e02b1aMediumScore 53/100First seen
SHA2566960d27fea1f5b28565cd240977b531cc8a195188fc81fa24c924da4f59a1389MediumScore 53/100First seen
SHA25699b8d3e04f6b16f3b79391360602ca28651c78a0db2f3868fec11eca71727a3dMediumScore 53/100First seen
IP195.246.231.60HighScore 58/100First seen
URLhttps://arkanix.pw/api/upload/directHighScore 58/100First seen
IP93.95.226.152HighScore 58/100First seen

IOC Relationship Graph

Building graph…