ARX stands for Addition, Rotation, and XOR, a family of simple bitwise operations used to mix data quickly. Because these operations are fast, compact, and easy to implement, they appear in legitimate software, lightweight cryptography, and low-level routines.
In cyber security, ARX matters because attackers sometimes adapt it for obfuscation, especially for string decoding or small custom ciphers. A malware sample may combine constants, rotations, and XOR steps to hide domains, commands, or API names until runtime. That makes static analysis harder and can reduce the value of string-based detections. Defenders look for the execution pattern, decoded memory content, and surrounding unpacking or interpreter logic rather than only the on-disk bytes. ARX is not the same as strong encryption; it is often a compact transformation that can be reversed once the algorithm and key are understood.