Skip to content
NewA calmer, faster ZeroHour
StoryMalwarehigh

ArcticRAT Android malware adds remote control and AI financial triage

3 sources · 3 articlesFirst reported Updated ()
What's new

November 13: Dark Reading reports newer builds add live control behind a black overlay and that operators use LLMs to filter stolen texts for fraud.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Zimperium says ArcticRAT is now a modular Android RAT that hides remote control and uses AI to filter stolen financial data.

Zimperium’s zLabs says ArcticRAT began as spyware against users of 11 cryptocurrency apps and is now a modular Android remote-access trojan. Victims reach a fake Google Play page through ads, texts or forums; a dropper uses a VPN permission with no upstream to install the payload while Play Protect telemetry is blinded. After Accessibility access, operators can control the phone over hidden VNC behind a black overlay, capture unlock codes and abuse Wireless Debugging on Android 11 and later. A command sends stolen app and SMS data to xAI’s grok-4.20-0309-non-reasoning model for financial triage. Researchers logged 78 samples, builds 6.3 through 6.5.2, 129 commands and 21 command servers; a fake ransomware screen encrypts nothing.

Key facts
  • Researchers logged 78 samples: 42 droppers, 36 payloads and 21 C2 addresses.
  • Builds 6.3 through 6.5.2 include 129 commands, according to zLabs.
  • AI features first appeared in samples from mid-July 2026.
  • Ports 9999, 8888, 5000 and 5055 carry control, HVNC, mic and screen data.
  • Zimperium compares the VPN method to China-linked RatHat but does not confirm the same operators.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

What each outlet adds

beyond the shared facts
  • GBHackersPorts, fake ransomware screen, RatHat comparison and mid-July AI samples.
  • Cyber Security NewsPackage names, AI storage path and Wireless Debugging abuse details.
  • Dark ReadingFrames newer builds as live control plus LLM financial filtering; article cuts off.
Vendors
GooglexAI
Products
AndroidGoogle Play Protect
Malware
ArcticRATRatHat
Organizations
ZimperiumzLabs
AI models
grok-4.20-0309-non-reasoning

Coverage

oldest first · one row per article · UTC
  1. · 1d ago GBHackersFirst report

    ArcticRAT Android trojan uses fake VPN installs and an LLM for financial triage

    zLabs catalogued 78 samples, builds 6.3 to 6.5.2, with grok-4.20 used to sort banking apps and SMS.

  2. · 1d ago Cyber Security News

    ArcticRAT Android malware hides live control behind a black screen

    Zimperium tracked 78 samples, 129 commands and hidden VNC, plus xAI calls that filter banking texts.

  3. · 18h ago Dark Reading

    ArcticRAT Android malware now profiles victim finances with AI

    Zimperium says newer builds add live device control and a black overlay while LLMs filter stolen SMS for fraud.