ArcticRAT Android malware now profiles victim finances with AI
Zimperium says newer builds add live device control and a black overlay while LLMs filter stolen SMS for fraud.
54
Malware
ArcticRAT
- Mentions · 7d3
- Mentions · 30d3
- All mentions3
- First seenNov 13, 2026
- Last mentioned18h ago
Timeline
3 articles · newest firstArcticRAT Android malware hides live control behind a black screen
Zimperium tracked 78 samples, 129 commands and hidden VNC, plus xAI calls that filter banking texts.
72
ArcticRAT Android trojan uses fake VPN installs and an LLM for financial triage
zLabs catalogued 78 samples, builds 6.3 to 6.5.2, with grok-4.20 used to sort banking apps and SMS.
72
Appears with
- Androidproduct · 3
- Zimperiumorganization · 3
- Googlevendor · 2
- grok-4.20-0309-non-reasoningai model · 2
- xAIvendor · 1
- Google Play Protectproduct · 1
- zLabsorganization · 1
- RatHatmalware · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.