A homemade bomb has reportedly been found in the lorry used to kill at least four people in Stockholm.
Police sources told public broadcaster SVT the device was found in a bag and had not been detonated, adding that the attacker had “burned himself”.
Dan Eliasson, head of the national police, confirmed police had found a suspicious object that "could be a bomb or an incendiary device" in the drivers’ seat and were analysing it.
Forensics officers and bomb disposal squads worked through the night at the site of the massacre in Drottningatan, a busy shopping area of the Swedish capital.
The lorry was left partially embedded in the Ahlens department store after being ploughed into pedestrians on Friday afternoon, killing four people and wounding 15 others.
The atrocity sparked panic in the Swedish capital, sending people running for cover as public transport and parliament went into lockdown.
A man arrested in Märsta, north of Stockholm, later on Friday is believed to be the driver of the lorry after being found “behaving suspiciously with minor injuries”.
He has not been formally identified but police described him as a 39-year-old man from Uzbekistan, who had reportedly expressed support for Isis online and was known to intelligence agencies.
Local media reported that he had expressed support for Isis on social media but prosecutors would not confirm any link with the group.
Police said they were analysing the man’s phone, contacts and online activity, amid claims he was linked to an Uzbek gang suspected of financing Isis with a fraudulent cleaning company.
A terror link could not be proven in court and three people were jailed for tax evasion and fraud over the scam in 2015, Expressen reported.
Sweden’s prosecutor said the 39-year-old has been arrested on suspicion of murder and terror offences, and will appear in court for a pre-trial custody hearing.
A second man believed to be linked to the main suspect was detained in the district of Hjulsta.
The attacker hijacked a lorry belonging to the Swedish brewery Spendrups as it made a delivery at a nearby restaurant, with a masked man climbing into the empty cab.
The firm said the driver did everything he could to stop his vehicle being stolen, standing in front of it before throwing himself to the side when the attacker almost ran him down, Expressen reported.
The lorry was used to ram into people in a pedestrianised street before crashing into Ahlens shortly before 3pm local time (2pm BST).
“I turned around and saw a big truck coming towards me. It swerved from side to side. It didn't look out of control, it was trying to hit people,” said Glen Foran, an Australian tourist.
“It hit people, it was terrible. It hit a pram with a kid in it, demolished it.”
Theresa May called Sweden's Prime Minister to express Britain's condolences on Saturday, Downing Street said.
“She was clear that the UK stands firmly by Sweden's side, and they agreed on the importance of working together to tackle these threats, which we all continue to face,” a spokesperson added.
Stefan Löfven told Swedes that the country “must get through this", saying "life must go on" after laying flowers near the site of the attack.
He called a day of national mourning on Monday, with a minute of silence to be held at noon after tributes were paid around the world.
There was no immediate claim of responsibility for the attack, although both Isis and al-Qaeda have recently released propaganda calling on followers to carry out vehicle rammings and containing bomb-making instructions.
Isis propaganda has continued attempting to incite terror attacks in Europe, the US, Australia and other countries supporting military operations against its fighters.
An issue of its Rumiyah magazine issued in November advised jihadis to launch vehicle attacks in an article citing the Nice lorry attack that killed 86 people as a “superb demonstration”.
“Having a secondary weapon, such as a gun or a knife, is also a great way to combine a vehicle attack with other forms,” it read.
The group previously claimed responsibility for a firebombing at a centre used by Shia Muslims in the Swedish city of Malmö.
No one was injured in the incident in October, with a 30-year-old Syrian man charged with terror offences after prosecutors found he had affiliated himself with Isis.
The most recent attack in Stockholm was in 2010, when an Iraqi-born Swede killed himself while detonating two bombs days before Christmas.
Join our new commenting forum
Join thought-provoking conversations, follow other Independent readers and see their replies