ArcticRAT Android malware hides live control behind a black screen
Original title: ArcticRAT Android Malware Uses Hidden VNC to Control Smartphones While Showing Victims a Black Screen
Zimperium tracked 78 samples, 129 commands and hidden VNC, plus xAI calls that filter banking texts.
Zimperium’s zLabs says ArcticRAT, once spyware aimed at users of 11 crypto apps, is now a remote access trojan. Droppers arrive via malicious ads, texts or forums, often as fake Google Play pages, and use a VPN permission to blind Play Protect while installing the payload. After Accessibility access, operators drive the phone over hidden VNC while a black overlay hides the session, steal unlock codes and can abuse Wireless Debugging on Android 11 and later. A fake ransomware screen encrypts nothing; a command queries xAI’s grok-4.20-0309-non-reasoning model to pick financial messages.
Unconfirmed: Findings are Zimperium’s; the article does not name victims or confirm payments from the fake ransomware screen.
- Researchers found 78 samples, 42 droppers, 36 payloads and 21 C2 addresses.
- Versions 6.3 through 6.5.2 show ongoing development, with C2 on port 9999 and VNC on 8888.
- Early packages include net.iceflow.arcticlink and net.frostlink.iceforge.
- AI answers are stored under /storage/emulated/0/config/AI_DATA/.
- Wireless Debugging abuse can enable Accessibility, clear the lock or set a new PIN.
Impact: Full remote control of phones and theft of banking and unlock data
| Product | Affected |
|---|---|
| Google Android | Android 11 and later for Wireless Debugging abuse; other features not version-limited in the text |
- 1.Install apps only from the official Play Store and avoid ad and text links.
- 2.Refuse unexpected Accessibility, VPN or screen-sharing prompts.
- 3.Disconnect and check a phone that suddenly goes dark or looks locked.
- Vendors
- Products
- Android
- Malware
- ArcticRAT
- Organizations
- Zimperium
- AI models
- grok-4.20-0309-non-reasoning
From the original article
4 min read at cybersecuritynews.com
A new Android remote access trojan called ArcticRAT can take full control of a phone while the owner sees only a black screen. The device looks locked or switched off, but an attacker is opening banking apps, approving permissions and stealing data in the background. The malware began as a small spyware tool aimed at […]
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.