“We suspect that the man who was arrested is the perpetrator,” Stockholm police spokesman Lars Bystrom told AFP.
Police on Friday detained the man who they said “matched the description” of a photo released of a suspect wearing a dark hoodie and military green jacket.
According to the Aftonbladet newspaper, the same man is a 39-year-old of Uzbek origin and a supporter of the Islamic State (IS) group.
If confirmed as a terror attack, it would be Sweden's first such deadly assault. The 15 injured included children and nine people were “seriously” wounded, health authorities said.
Prime Minister Stefan Löfven said he had strengthened the country's border controls.
“Terrorists want us to be afraid, want us to change our behaviour, want us to not live our lives normally, but that is what we're going to do. So terrorists can never defeat Sweden, never,” he said.
The attack occurred just before 3:00 pm (1300 GMT) when the stolen truck slammed into the corner of the bustling Åhléns store and the popular pedestrian street Drottninggatan, above ground from Stockholm's central subway station.
Pictures taken at the scene showed a large blue beer truck with a mangled undercarriage smashed into the Åhléns department store.
Witnesses described scenes of terror and panic.
“A massive truck starts driving … and mangles everything and just drives over exactly everything,” eyewitness Rikard Gauffin told AFP.
“It was so terrible and there were bodies lying everywhere… it was really terrifying,” he added.
The truck was towed away in the early hours of Saturday.
EYEWITNESSES: 'The walls came towards us like an avalanche'
Police cars and ambulances rapidly flooded the scene after the attack, as central streets and squares were blocked off amid fears that another attack could be imminent.
Helicopters hovered overhead across the city, sirens wailed, and police vans criss-crossed the streets using loudspeakers to urge people to head straight home and avoid crowded places.
But with the metro system and commuter trains shut down for several hours after the attack, other streets heading out of the city were packed with thousands of pedestrians trying to find a way home.
Haval, a 30-year-old sales clerk who didn't want to reveal his last name, was in the metro at the time of the attack.
His train stopped immediately and he had to get out, along with all the other passengers.
They walked along the street before being ushered inside a nearby hotel for safety.
“We were suddenly trapped inside a hotel and there was the worst kind of horror in there,” he told AFP.
“We were scared, we were scared something else would happen, he added.
READ ALSO: World leaders react to Stockholm attack
'Bleeding to death'
Marko was in coffee shop near the scene with his girlfriend when he saw the truck ram into the store.
“He hit a woman first, then he drove over a bunch of other people … We took care of everyone lying on the ground,” he told Swedish daily newspaper Aftonbladet.
Hasan Sidi, another passerby, told Aftonbladet he saw two elderly women lying on the ground.
He said people at the scene urged him to help one of the women who was “bleeding to death”.
“One of them died… I don't know if the other one made it,” Sidi said.
“The police were shocked. Everyone was shocked.”
'You can't break us'
In an editorial, Sweden's biggest broadsheet Dagens Nyheter wrote: “What we feared for a long time finally happened.”
“The fear and panic right after the incident was inevitable. The images from the attack were terrible,” the paper said.
But Stockholm managed to stay “cool-headed” even though the attacker struck “Sweden and Stockholm's heart”, it added.
Friday's attack was the latest in a string of similar assaults with vehicles in Europe, including in London, Berlin and the southern French city of Nice.
The deadliest came last year in France on the July 14 Bastille Day national holiday, when a man rammed a truck into a crowd in the Mediterranean resort of Nice, killing 86 people.
Last month, Khalid Masood, a 52-year-old convert to Islam known to British security services, killed five people when he drove a car at high speed into pedestrians on London's Westminster Bridge before launching a frenzied knife attack on a policeman guarding the parliament building.
And in December, a man hijacked a truck and slammed into shoppers at a Christmas market in Berlin, killing 12 people.
In 2014, Isis called for attacks on citizens of Western countries and gave instructions on how they could be carried out without military equipment, using rocks or knives, or by running people over in vehicles.