ArcticRAT Android trojan uses fake VPN installs and an LLM for financial triage
Original title: New ArcticRAT Malware Uses Fake VPN Connections to Evade Google Play Protect During Installation
zLabs catalogued 78 samples, builds 6.3 to 6.5.2, with grok-4.20 used to sort banking apps and SMS.
Zimperium’s zLabs describes ArcticRAT, an Android remote access trojan that began as spyware against users of 11 cryptocurrency apps and now supports modular device takeover. Victims reach a fake Google Play page via malvertising, smishing or forums; a dropper requests VPN privileges, routes 0.0.0.0/0 with no upstream, and stages the payload while Play Protect telemetry is blinded. After Accessibility access, it streams the screen, captures lock credentials and can self-pair over Wireless Debugging. A command sends stolen app and SMS data to xAI’s grok-4.20-0309-non-reasoning model for financial triage.
Unconfirmed: The China link is stated for RatHat, not confirmed for ArcticRAT operators.
- Researchers logged 42 droppers, 36 payloads, 21 C2 IPs and 129 commands.
- AI features first appeared in samples from mid-July 2026.
- Ports 9999, 8888, 5000 and 5055 carry control, HVNC, mic and screen data.
- A fake ransomware screen shows an endless bar but encrypts no files.
- Zimperium compares the method to China-linked RatHat, not confirmed as the same operators.
Impact: Full Android takeover plus theft of financial SMS and app data
- 1.Watch for unexpected VPN prompts, Accessibility grants to sideloaded apps, and Wireless Debugging enabled without user action.
- 2.Block sideloading and use mobile threat defense on managed devices.
- Products
- AndroidGoogle Play Protect
- AI models
- grok-4.20-0309-non-reasoning
From the original article
3 min read at gbhackers.com
ArcticRAT, an Android remote access trojan (RAT). It started as spyware aimed at users of 11 cryptocurrency apps and has grown into a modular, AI-assisted tool for full device takeover. The most notable change is that its operators now send stolen SMS and app data to a large language model (LLM) for automated financial triage.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.