APT / THREAT GROUP

Arkei Stealer

aliases

Last seen:Mar 17, 2026

Intelligence Profile

Arkei is a stealer that appeared around May 2018. It collects data about browsers (saved passwords and autofill forms), cryptocurrency wallets, and steal files matching an attacker-defined pattern. It then exfiltrates everything in a zip file uploaded to the attacker's panel. Later, it was forked and used as a base to create Vidar stealer.

Threat Analysis

Arkei Stealer is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://blog.minerva-labs.com/a-long-list-of-arkei-stealers-browser-crypto-wallets

→https://blogs.blackberry.com/en/2022/02/threat-thursday-arkei-infostealer

→https://drive.google.com/file/d/1wTH-BZrjxEBZwCnXJ3pQWGB7ou0IoBEr/view

→https://forensicitguy.github.io/analyzing-stealer-msi-using-msitools/

→https://fumik0.com/2018/12/24/lets-dig-into-vidar-an-arkei-copycat-forked-stealer-in-depth-analysis/

Quick Facts

TypeAPT / Threat Group

Aliases3

Also Known As

ArkeiStealerArkei Stealerwin.arkei_stealer

External Intelligence

Malpedia: win.arkei_stealer

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search Arkei Stealer