{
 "tag": "discord",
 "name": "Discord",
 "group": "Platforms & channels",
 "incidents": [
  {
   "slug": "arkanix-stealer-llm-assisted-crypto-wallets-feb-2026",
   "title": "Arkanix stealer, likely built with LLM help, targeted crypto wallets before its makers shut it down",
   "url": "https://drains.watch/i/arkanix-stealer-llm-assisted-crypto-wallets-feb-2026",
   "json": "https://drains.watch/i/arkanix-stealer-llm-assisted-crypto-wallets-feb-2026.json",
   "status": "closed",
   "severity": "low",
   "threatStatus": "contained",
   "verification": "verified",
   "ai": {
    "role": "ai-malware",
    "note": "Kaspersky says the stealer contains probable traces of LLM-assisted development and was likely an AI-assisted experiment."
   },
   "chains": [
    "multi-evm"
   ],
   "method": null,
   "product": "People infected with the Arkanix stealer (Exodus, Atomic and browser wallet users)",
   "tags": [
    "multi-evm",
    "infostealer",
    "malware-as-a-service",
    "arkanix",
    "exodus",
    "atomic-wallet",
    "llm-assisted",
    "kaspersky",
    "discord",
    "ai"
   ],
   "amountUsd": null,
   "victims": null,
   "startedAt": "2026-02-24",
   "closedAt": "2026-02-24",
   "updatedAt": "2026-02-24T12:00:00Z",
   "summary": "Kaspersky analysed Arkanix, a malware-as-a-service info-stealer advertised on dark-web forums and Discord from October 2025, as Security Affairs reported on 24 February 2026. It took crypto wallet data, with paid builds offering injection into Exodus and Atomic wallets, along with browser passwords, cookies, Telegram sessions and Discord logins. Kaspersky says the code shows probable traces of LLM-assisted development, and the operators shut the project down about two months after launch. No victim counts or losses were published."
  }
 ],
 "changes": [
  {
   "incident": "arkanix-stealer-llm-assisted-crypto-wallets-feb-2026",
   "incidentTitle": "Arkanix stealer, likely built with LLM help, targeted crypto wallets before its makers shut it down",
   "severity": "low",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-02-24",
   "title": "Security Affairs reported Kaspersky's analysis of Arkanix and the project's shutdown.",
   "sourceUrl": "https://securityaffairs.com/188431/malware/arkanix-stealer-ai-assisted-info-stealer-shuts-down-after-brief-campaign.html",
   "url": "https://drains.watch/i/arkanix-stealer-llm-assisted-crypto-wallets-feb-2026"
  }
 ]
}