ArcticRAT Android trojan uses Grok to mine stolen texts for banking data

What's going on

On November 12, 2026, security firm Zimperium published a detailed report on an Android malware strain called ArcticRAT. RAT stands for "Remote Access Trojan": malware that lets attackers control someone else's device remotely, as if they were holding it. Researchers on the company's zLabs team picked the name because of distinctive package names in early samples, such as net.iceflow.arcticlink and net.frostlink.iceforge.

According to Zimperium, ArcticRAT started out as targeted spyware aimed at users of eleven specific cryptocurrency apps. It has since grown into a full remote-control tool, and one that uses artificial intelligence. Starting around mid-July 2026, variants showed up that send stolen data to a large language model (LLM) to analyze it automatically. Specifically, the researchers saw requests to xAI's application programming interface (API) using the model grok-4.20-0309-non-reasoning.

The investigation covered 78 individual malware samples, including 42 so-called droppers and 36 actual malicious programs (payloads). It also turned up 21 attacker server addresses and 129 different commands in the code.

How the trojan gets onto your phone

The infection doesn't start in the official Play Store. Victims reach a website that convincingly mimics Google Play through malicious ads (malvertising), scam text messages (smishing) or links posted in forums. According to the report, some files were also served directly from Amazon Web Services storage buckets. The apps carry real brand logos and pose as the Amazon app, TikTok, a file manager or a popular crypto app.

At first, you only install a dropper: a harmless-looking program whose sole job is to fetch the actual malware. The dropper asks for permission to set up a VPN. That VPN isn't there to protect your privacy, though. It routes all network traffic into a dead end, so Google Play Protect, Android's built-in malware scanner, can't report anything to Google during installation. A fake installation screen keeps you distracted while the dropper decrypts the hidden main program, installs it and shuts the VPN down again.

Next, the malicious app requests access to Accessibility Services. This Android feature is meant to help people with disabilities, but it also lets apps read what's on screen and trigger taps. Grant it, and you've effectively handed over control of your device.

What ArcticRAT can do

Once installed, the malware connects to its command servers (C2 servers, short for "command and control") over direct TCP connections. Zimperium says that of 17 addresses it examined more closely, two-thirds are in Hong Kong and about 20 percent are in Germany. (Elsewhere the report mentions 21 addresses, so the figures don't fully match.) The malware first sends a detailed device profile: battery level, screen status, Wi-Fi connection and even the current wallpaper. The wallpaper check helps confirm it's running on a real phone and not in a security researcher's sandbox. Only then does the server decide which attacks to launch. The malware uses separate ports for different jobs, for example 9999 for the main connection, 8888 for remote control and 5000 for microphone eavesdropping.

The key features at a glance:

• Hidden VNC (HVNC): An invisible virtual screen that attackers use to operate the phone live, for example to open banking apps, without the victim seeing anything. The display is streamed as a sequence of JPEG images.
• Black screen: While the attackers work, the malware places a black overlay over the display that can't be dismissed and turns brightness down to zero. The phone looks like it's switched off.
• Keylogger: Every keystroke is recorded and saved as a daily JSON file in the hidden folder /storage/emulated/0/config/System/, along with tap histories and screenshots.
• Fake lock screen: On command, a convincing prompt asks for your pattern, PIN or password. The malware then quietly checks what you entered using the system command locksettings verify.
• Fake ransomware: A simulated encryption trojan locks the screen with a progress bar that never finishes and demands cryptocurrency. Nothing actually gets encrypted. It's purely psychological pressure.
• More spying: It grabs location data, contacts, notifications and calls, can trigger USSD codes and send text messages in secret. On command, the malware can also delete itself to cover its tracks.

AI as the data analyst

The new feature, and according to Zimperium the most significant development, is the <xAI_API> command. Until now, criminals had a problem: they had to go through huge piles of stolen data by hand. Now the server sends an API key to the infected phone, and the malware queries the language model directly using hardcoded instructions (prompts).

The first prompt has the model go through the list of installed apps and pick out banking, crypto and trading apps, which are the most lucrative targets. The second prompt processes the stolen text messages: it throws out ads and keeps one-time login codes, balance changes and transfer notifications. The model is also told to assess the victim's financial situation from the text and return everything as structured JSON. The results are cached in the /config/AI_DATA/ folder and sent to the attackers on the <Get_AI_ANA_Data> command.

Zimperium notes that a similar development had already been seen in another malware strain called RatHat. The report doesn't say whether xAI was informed about the abuse or whether the API keys involved have been revoked.

Bypassing the screen lock via wireless debugging

Newer versions abuse wireless debugging, a developer feature Android has offered since version 11. Through the Android Debug Bridge (ADB), a tool developers use to run commands with elevated privileges on a device, the malware gets a privileged shell. To do this, it scans the local network for the pairing service, and the attacker supplies the six-digit pairing code through their control panel.

With those privileges, attackers can quietly enable the malware's own accessibility permissions, remove the screen lock entirely or set a new PIN, pattern or password, locking the victim out of their own phone. To survive a reboot, the software listens for system events, including vendor-specific ones from Huawei, Vivo and Oppo.

According to Zimperium, its analysis of versions v6.3 through v6.5.2 shows the malware is being actively developed. The company has published a full list of commands and indicators of compromise (IOCs) in a repository.

Our take

ArcticRAT shows how pragmatically criminals use language models: not for spectacular new attacks, but as a cheap clerk that sorts the loot. That cuts the effort involved and makes mass attacks pay off, because the AI fishes the relevant codes and balances out of thousands of text messages. The fact that a commercial model from a major provider is being used through its regular API raises questions about how well AI companies detect abuse.

Keep in mind that the report comes from a mobile security vendor and ends with an ad for its own products. The technical details are thorough and well documented, but the sources contain no independent confirmation from other researchers. There's also no information on the number of victims or which countries are affected.

For users, the usual ground rules matter more than ever: only install apps from the official Play Store, even if a website looks just like Google Play. Be suspicious if an app asks for accessibility or VPN permissions that don't fit what it does. And keep wireless debugging switched off unless you need it as a developer.