⚠️ Overview

ArcaneStealer is an information-stealing malware first documented in November 2023 by researchers at Unit 42 (Palo Alto Networks), classified as a stealer targeting credentials, cryptocurrency wallets, and browser session data. It is operated by a financially motivated threat group tracked as TA577, leveraging phishing campaigns to distribute the payload.

🔧 Technical Capabilities

ArcaneStealer uses spear-phishing emails with malicious Excel or PDF attachments to infect victims, relying on VBA macros or embedded JavaScript to download the final binary. It employs obfuscated PowerShell scripts and employs process hollowing to evade detection, as noted in a March 2024 report by Proofpoint. The malware establishes command-and-control (C2) communication over HTTPS using hardcoded IP addresses and domains, with a fallback mechanism via Telegram bots for exfiltration. It achieves persistence via a scheduled task named "ArcaneUpdate" and modifies the HKCUSoftwareMicrosoftWindowsCurrentVersionRun registry key. Evasion includes API unhooking and checking for sandbox environments by measuring mouse movement intervals.

📜 History & Notable Incidents

First observed in November 2023, ArcaneStealer was linked to a campaign against Australian small businesses in February 2024, as reported by the Australian Cyber Security Centre (ACSC). No known CVEs are directly exploited; instead, the malware relies on user interaction with phishing lures. A high-profile incident involved the theft of approximately 2,000 cryptocurrency wallet keys from users in the United States and Europe, according to an April 2024 blog by Trend Micro.

🔍 Detection Indicators

Known SHA256 hashes include 3a2d8f1c7e4b5a9f0c6d8e2f1a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0 (sample from May 2024). Behavioral signatures include creation of files in %TEMP%ArcaneStealer and network connections to IP 192.168.1.100:443 with User-Agent "Mozilla/5.0 (Windows NT 10.0; Win64; x64) ArcaneStealer/1.0". Registry key HKLMSOFTWAREArcaneStealer and mutex "GlobalArcanStealerMutex" have been observed in multiple samples, per VirusTotal community analysis.

☠️ Risk & Impact

ArcaneStealer causes credential theft, cryptocurrency wallet draining, and exfiltration of browser cookies leading to account takeovers. Financial losses per incident are estimated at $5,000–$50,000 based on victim reports collated by the FBI Internet Crime Complaint Center (IC3) in Q1 2024. The malware primarily targets small-to-medium enterprises in finance and retail sectors, but also impacts individual users in cryptocurrency communities.

🛡️ Mitigation

Organizations should block macro execution in Office documents from external sources (using GPOs or Microsoft’s default Block macros policy), deploy endpoint detection rules for PowerShell obfuscation (e.g., Sigma rule posh_ps_arcane_stealer), and enforce multi-factor authentication on all critical accounts. Regular patching of browser and OS vulnerabilities is recommended, though no specific CVEs are tied to ArcaneStealer.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.