MALWARE FAMILY

Arkei Stealer

Internal ID: win.arkei_stealer

aliases

Last seen:Mar 17, 2026

Intelligence Profile

Arkei is a stealer that appeared around May 2018. It collects data about browsers (saved passwords and autofill forms), cryptocurrency wallets, and steal files matching an attacker-defined pattern. It then exfiltrates everything in a zip file uploaded to the attacker's panel. Later, it was forked and used as a base to create Vidar stealer.

Threat Analysis

Arkei Stealer is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→https://blog.minerva-labs.com/a-long-list-of-arkei-stealers-browser-crypto-wallets

→https://blogs.blackberry.com/en/2022/02/threat-thursday-arkei-infostealer

→https://drive.google.com/file/d/1wTH-BZrjxEBZwCnXJ3pQWGB7ou0IoBEr/view

→https://forensicitguy.github.io/analyzing-stealer-msi-using-msitools/

→https://fumik0.com/2018/12/24/lets-dig-into-vidar-an-arkei-copycat-forked-stealer-in-depth-analysis/

→https://info.spamhaus.com/hubfs/Botnet%20Reports/2022%20Q3%20Botnet%20Threat%20Update.pdf

→https://isc.sans.edu/diary/Arkei+Variants%3A+From+Vidar+to+Mars+Stealer/28468

→https://isc.sans.edu/diary/rss/28468

→https://ke-la.com/information-stealers-a-new-landscape/

→https://m4lcode.github.io/malware%20analysis/vidar/

Quick Facts

TypeMalware Family

Aliases1

Also Known As

win.arkei_stealer

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search Arkei Stealer