- A man has been arrested on suspicion of terrorist crimes through murder
- Swedish PM Stefan Lofven described the incident as a "terror attack"
- Swedish intelligence agency Sapo said it was a deliberate attack
Sweden's legal system has several degrees regarding the strength of suspicion.
"One person has been arrested on suspicion of terrorist crimes through murder," Karin Rosander, press spokesperson at the prosecutors office told Reuters.
Swedish public broadcaster SVT reported police had arrested a second man and that he had a connection to the previously arrested person, citing police sources. The police declined to comment on whether it had arrested any additional suspects.
"Our message will always be clear: you will not defeat us, you will not govern our lives, you will never, ever win," Prime Minister Stefan Lofven, who had earlier described the assault as a terrorist attack, told a news conference.
There was no immediate claim of responsibility.
"I turned around and saw a big truck coming towards me. It swerved from side to side. It didn't look out of control. It was trying to hit people," Glen Foran, an Australian tourist in his 40s, told Reuters.
"It hit people; it was terrible. It hit a pram with a kid in it, demolished it," he said.
"It took a long time for police to get here. I suppose from their view it was quick, but it felt like forever."
The area of the attack in central Stockholm was evacuated, including the main rail station, and remained cordoned off late on Friday. All subway traffic was halted on police orders and government offices were closed.
A Reuters witness at the scene saw police officers put what appeared to be two bodies into body bags.
Bloody tyre tracks showed the path of the truck, which was stolen by a masked hijacker while making a beer delivery to a tapas bar further up Drottninggatan, according to Spendrups Brewery spokesman Marten Lyth.
"We were standing by the traffic lights at Drottninggatan and then we heard some screaming and saw a truck coming," a witness who declined to be named told Reuters.
"Then it drove into a pillar at (department store) Ahlens City, where the hood started burning. When it stopped we saw a man lying under the tyre. It was terrible to see," said the man, who saw the incident from his car.
Police said four people had died and 15 were injured. National news agency TT said those hurt included the delivery driver, who had tried to stop the hijack.
ISIS claimed responsibility for an attack in Nice, France, last July, when a truck killed 86 people celebrating Bastille Day, and one in Berlin in December, when a truck smashed through a Christmas market, killing 12 people.
"Hijacking a truck, that has happened before," Magnus Ranstorp, head of terrorism research at the Swedish Defence University, told Reuters.
"And this is a pretty cunning modus operandi. To drive to Ahlens and stop ... There is a way down to the subway just a few metres away from there, and then you ... can jump on any train you want and quickly disappear."
Stockholmers opened up their homes and offered lifts to people who were unable to get home or needed a place to stay.
"Our thoughts are going out to those that were affected, and to their families," Sweden's King Carl Gustaf said in a statement, while European Union chief executive Jean-Claude Juncker said an attack on any of the bloc's member states "is an attack on us all".
The attack was the latest to hit the Nordic region after shootings in Danish capital Copenhagen in 2015 that killed three people and the 2011 bombing and shooting by far right extremist Anders Behring Breivik that killed 77 people in Norway.
In February US President Donald Trump falsely suggested there had been an immigration-related security incident in Sweden, to the bafflement of Swedes.
Swedish authorities raised the national security threat level to four on a scale of five in October 2010 but lowered the level to three, indicating a "raised threat", in March 2016.
Police in Norway's largest cities and at Oslo airport will carry weapons until further notice following the attack. Denmark has been on high alert since the February 2015 shootings. Traffic was restricted on the Oresund Bridge linking Denmark and Sweden at the request of Swedish police.
Neutral Sweden has not fought a war in more than 200 years, but its military has taken part in U.N. peacekeeping missions in a number of conflict zones in recent years, including Iraq, Mali and Afghanistan.
The Sapo security police said in its annual report it was impossible to say how big a risk there was that Sweden would be targeted like other European cities, but that, if so "it is most likely that it would be undertaken by a lone attacker".
(Reporting by Stockholm newsroom; Writing by Gwladys Fouche; Editing by Lisa Shumaker and Richard Pullin)