A newly discovered information-stealing malware called Arcane is stealing extensive user data, including VPN account credentials, gaming clients, messaging apps, and information stored in web browsers. The campaign distributing Arcane Stealer relies on YouTube videos promoting game cheats and cracks, tricking users into following a link to download a password-protected archive. Previously, the attacks used another stealer malware family called VGS, a rebranded version of the Phemedrone trojan, but they switched to Arcane in November 2024. The Arcane malware campaign started in November 2024, having gone through several evolutionary steps, including primary payload replacements. According to Kaspersky, the malware has no links or code that overlaps with the Arcane Stealer V, which has been circulating on the dark web for years. Bill Toulas Bill Toulas is a tech writer and infosec news reporter with over a decade of experience working on various online publications, covering open-source, Linux, malware, data breach incidents, and hacks. All conversations and public posts by its operators are in Russian, with Kaspersky's telemetry showing that most Arcane infections are in Russia, Belarus, and Kazakhstan. Kaspersky also found recent changes in the distribution method, including the use of a fake software downloader, supposedly for popular game cracks and cheats, named ArcanaLoader. Kaspersky comments that Arcane's broad data theft makes it stand out in the populous infostealer space. Arcane also captures screenshots that can reveal sensitive information about what you are doing on the computer and retrieves saved Wi-Fi network passwords. This is particularly notable, as most threat actors based in Russia typically avoid targeting users within the country and other CIS nations to prevent conflicts with local authorities. Even though Arcane currently has specific targeting, its operators could expand it to cover additional countries or themes.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Wed, 19 Mar 2025 17:55:04 +0000