The man in custody, whose appearance matches the description of a person of interest, is being held on "suspicion of terrorist crimes through murder," Karin Rosander, spokeswoman for Sweden's prosecutor's office, told CNN via email early Saturday.
A dozen people were injured in the attack Friday, in what appeared to be the latest use of a vehicle as a weapon of terror in Europe.
The Swedish Security Service said the attack happened just before 3 p.m. local time. People were seen fleeing the area in panic.
Police told reporters that the man in custody matched the description of a person of interest whose photo authorities had released. It's not known whether the suspected driver had been arrested.
Earlier, Anders Thornberg, director general of the Swedish Security Service, said a "person of interest" was being investigated and authorities released a photo of him.
Police also confirmed they were talking to two individuals about the attack, but stressed they were not suspects.
Parliament and the Stockholm subway were placed in lockdown. All train services in and out of Stockholm Central Station were halted and people were evacuated, the state railway company said.
"Sweden has been attacked," Prime Minister Stefan Lofven told reporters "Everything indicates this is a terror attack."
Lofven said the government was doing everything possible to help the security services. "We are thinking about the victims -- their families and friends -- and those who were injured," he said.
The Prime Minister returned to the capital from the west of the country, his spokesman Erik Nises told CNN.
"We will always do everything we can to protect Sweden, but we can't guarantee that it won't happen again," Lofven told reporters later Friday.
"If this is a terrorist attack, terrorists ... want us to not live our lives normally," he said. "But that is what we are going to do. So terrorists can never defeat Sweden. Never."
King Carl XVI Gustaf announced he had cut short his state visit to Brazil to return home immediately in the aftermath of the attack.
'He put his foot on the gas'
According to eyewitness Veronica Durango, the driver "put his foot on the gas and ran through the crowd."
"He came from Olof Palmes Street and drove down to Drottninggatan," Durango told CNN in a phone interview.
"It was like he was driving through paper. It's like it was nothing. I can't even believe how a person could do such a thing. And then he just kept on going. I was in shock."
Spendrups Brewery, which owns the truck used in the attack, said the vehicle was "hijacked" by a "masked man" shortly before 3 p.m. local time.
Spokeswoman Rose-Marie Hertzman told CNN that the company's driver attempted to chase after the truck but was nearly run over.
"Plenty of people have been injured and some have died in the attack that just hit Stockholm," said Nina Odermalm Schei, head of press for the security service.
"We are still trying to determine who the attacker was, if the attack was carried by one or more people, and the number of injured."
Carl Bildt, a former prime minister, wrote on Twitter: "Steal a lorry or a car and then drive it into a crowd. That seems to be the latest terrorist method. Berlin. London. Now Stockholm."
Jens Stoltenberg, secretary general of NATO, said: "My heartfelt sympathies go to all those affected. We stand with the Swedish people in their grief."
The Swedish Security Service first received notification at 2.55 p.m. on Friday that a truck had been driven into a crowd on Drottninggatan in Stockholm, a press officer told CNN.
Intensive intelligence work was underway in order to identify the person or persons behind the attack, the spokesman said.
The US Embassy in Stockholm told US citizens to avoid the area of the attack.
The same area was hit by a failed attack in 2010. A suicide bomber died and two people were injured when his car bomb went off prematurely as he made his way towards the Drottninggatan street area, which was packed with Christmas shoppers.
Late Friday, the streets of the Swedish capital were silent. Taxis circled the area for fares but no one was around.
It was an unusual scene: Normally, central Stockholm would be bustling with residents ready to enjoy the weekend. The only people here were the investigators and the pack of journalists held behind the blue police tape.
A cordon remained in place around the crash site; the back of the truck was visible -- still wedged in the building.
On a chilly night, bundled-up firefighters and heavily armed officers were on scene, along with two tow trucks that were preparing to remove the hijacked vehicle.
The attack joins a growing pattern of vehicles being used to launch attacks on pedestrians.
Last month, a man rammed into crowds on Westminster Bridge in London,
killing three people before stabbing a policeman to death outside Parliament. A fifth victim who was knocked off the bridge and into the River Thames below died after her life-support was switched off this week.
In July 2016, more than 80 people were killed and over 200 injured
when a terrorist used a 20-ton truck to plow into crowds who had gathered in Nice to watch Bastille Day fireworks.
Last December, 12 people were killed and at least 48 people were wounded when a truck drove into a Christmas Market in Berlin.