Zimperium discloses ArcticRAT, an Android trojan with AI-powered financial profiling

Zimperium’s zLabs team disclosed ArcticRAT on Nov. 12, 2026, an Android remote access trojan that began as spyware targeting 11 cryptocurrency apps before evolving into an AI-powered threat. Researchers first saw the AI integration in samples from around mid-July 2026, a shift to live device takeover and automatic financial parsing.

Researchers counted 78 unique ArcticRAT samples, made up of 42 droppers and 36 payloads linked to 21 command-and-control IP addresses. The trojan carries 129 distinct commands in its control code. Most of that infrastructure sits in Hong Kong and Germany, while the rest spans other countries. Zimperium calls the campaign ongoing, with active development spanning versions v6.3 through v6.5.2.

Distribution channels include fake Google Play listings, malvertising, SMS phishing, and third-party forums, with payloads also served from Amazon Web Services buckets. Threat actors impersonate Amazon, generic file managers, TikTok, and cryptocurrency applications to trick users into installing malicious software.

ArcticRAT misuses Android Accessibility Services to seize remote control and run automated fraudulent activity on infected devices. A hidden VNC command builds an in-memory virtual display and streams screen frames as JPEG binaries carrying header metadata. It opens sockets over TCP on ports 9999, 8888, and 5000, separating command-and-control traffic, hidden VNC video, and microphone audio streams.

Once Accessibility Services are granted, the trojan walks the view tree to grab credentials, authentication codes, and private messages from active input views. Keystrokes go into date-stamped JSON files under /storage/emulated/0/config/System/, and touch data plus screenshots go to Click_data/ and screenshot/ folders.

A black overlay cuts brightness to zero and draws an un-dismissible screen that hides attacker activity while a banking app is open or permissions change. A lock screen overlay copies the system display to capture the victim’s unlock pattern, PIN, or password when the Phsing directive arrives. It checks stolen credentials by running locksettings verify with the –old flag and no visible prompts shown.

Recent versions misuse Android 11 Wireless Debugging to open a privileged shell session with no USB cable needed. Attackers can turn accessibility services on or off using ADB shell commands, and they can clear or replace the victim’s lock screen credentials.

The dropper asks for VPN privileges to null-route traffic and blind Google Play Protect telemetry during staging. The payload installs from internal assets through the native Android session installer before the VPN link drops. A fake installation interface built with WebView tricks users before the secondary payload deploys.

The trojan gathers device telemetry such as battery levels, screen states, and Wi-Fi status into a DEVINFO JSON payload. It takes a screenshot of the user’s wallpaper to verify it runs on a physical device instead of a sandbox. The command-and-control server picks attack routines on the fly based on the victim’s host profile.

Command-and-control directives can remove specific app packages or trigger self-uninstallation to stop forensic examination. A fake ransomware overlay imitates disk locking with a looping progress bar without actually encrypting files. Operators run a two-stage overlay sequence, Attack_run then Attack_custom, to trap users and insert dynamic ransom note content.

Large Language Model APIs are built into the data exfiltration pipeline to parse stolen SMS messages and app data for financial intelligence. The sample reaches the xAI API using model grok-4.20-0309-non-reasoning and stores replies as JSON files in /storage/emulated/0/config/AI_DATA/. ArcticRAT reaches Grok through xAI’s public API, the same interface open to legitimate developers.

A second prompt reviews harvested SMS messages, throws out promotional noise, and pulls out one-time passcodes along with balance changes and transfer notices. One AI prompt reviews installed applications to filter software tied to banking, cryptocurrency, or trading platforms. The AI estimates the victim’s financial standing by reading text patterns and exports the result as a structured JSON payload. When it receives the Get_AI_ANA_Data command, the malware pulls cached JSON artifacts and sends them to its command-and-control server.

Zimperium says ArcticRAT’s improved abilities now target authentication codes that secure cryptocurrency accounts. Zimperium says signature-based security alone no longer shields enterprise mobile endpoints from compromise.

In September 2026, researchers disclosed RatHat, an Android malware that applied AI to simplify two-factor authentication attacks. Zimperium zLabs researchers tied RatHat to China-based threat actors after finding Chinese-language LLM prompts in the malware. RatHat runs an AI engine that turns the Android Accessibility tree into XML and transmits it to an unnamed assistant for real-time navigation instructions.

Google said that no apps containing RatHat appear on Google Play. The company also said Play Protect defends against known versions automatically. Zimperium said, “RatHat uses AI to intelligently navigate and control the device interface in real-time.”