What is the Arcane infostealer, and what data does it steal?
Arcane (also known as Arcane Stealer and VGS Stealer (predecessor)) is an information-stealing malware family. Arcane targets browser credentials, cryptocurrency wallets, Steam/Telegram/Discord session tokens, Browser DPAPI keys cracked via embedded xaitax utility, VPN client configs (OpenVPN, Mullvad, NordVPN, IPVanish, Surfshark, Proton, hide.me, PIA, CyberGhost, ExpressVPN), Network utility configs (ngrok, Playit, Cyberduck, FileZilla, DynDNS) and System hardware inventory and saved Wi-Fi networks. As of 11/10/2026, CyStack's research records 3 variants distributed through 1 channel, with high attribution confidence.
