Next-Gen Stealer Arkanix Bypasses Chrome App-Bound Encryption Using C++ Process Injection

A new threat dubbed Arkanix has emerged from G DATA, rapidly evolving from a Python script to a sophisticated C++ stealer capable of bypassing Chrome’s app-bound encryption. The article notes the C++ build uses VMProtect for obfuscation and features a post-exploitation tool called Chrome Elevator, which “uses process injection to inject a binary into the Chrome process and lets the injected code dump Chrome data by running in the context of the browser” to defeat the ABE measure introduced in Chrome 127.

According to the report, Arkanix aims at quick financial gains and collects data from a wide range of sources, including Chromium-based browsers and crypto-wallet extensions such as Exodus Web3 and MetaMask, as well as gathering system hardware details and Wi‑Fi passwords. The malware is distributed on Discord and is gatekept behind an invite-only web panel. The article confirms that both Python and the premium C++ versions share the same objective: total information extraction. 2 December 2025.