Malware

Arsink

Arsink is an Android remote access trojan (RAT) identified by Zimperium zLabs. It is distributed outside Google Play and impersonates more than 50 popular brands, including WhatsApp and TikTok, typically masquerading as “Pro” or “Mod” versions of legitimate apps. Delivery has been observed via links shared on Telegram and Discord and through MediaFire. Researchers reported 1,216 unique Arsink variants.

The malware requests extensive permissions and often acts as an empty-shell dropper. Some samples hide their app icon after installation, and some include a hidden secondary payload that can enable infection even when the device is offline. After installation, Arsink runs persistent background services and gives operators broad remote-control and surveillance capabilities. Reported functionality includes audio recording, reading SMS messages, stealing photos, accessing contacts and call history, obtaining the victim’s Google account email address, tracking location, forcing phone calls, and wiping device storage. Arsink has also been reported to use Google Apps Script infrastructure for media and file exfiltration.

Exfiltrated data has been sent through a large and resilient backend using 317 different database points, including Firebase, Telegram bots, and hidden folders on Google Drive. Separate reporting also states Arsink uses Firebase and Telegram for command-and-control. Zimperium reported the campaign affected about 45,000 devices across 143 countries, with major victim concentrations in Egypt (~13,000), Indonesia (~7,000), and Iraq (~3,000); other reporting also mentions Yemen and Türkiye among infection concentrations. Arsink is associated in reporting with an improved variant named SURXRAT, which researchers assessed to be an improved version or successor of Arsink.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

4 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

1 technique

T1583.006Web ServicesEvidence1

"Arsink, which uses Google Apps Script infrastructure"

Initial Access

2 techniques

T1189Drive-by CompromiseEvidence1

The malware spreads primarily through seemingly legitimate websites that trick users into downloading malicious applications.

T1566PhishingEvidence1

"An Android banking trojan called deVixor has been actively targeting Iranian users through phishing websites that impersonate legitimate automotive businesses..."; "...distributed via Telegram, Discord, and MediaFire links, while impersonating various popular brands."

Stealth

1 technique

T1036MasqueradingEvidence1

Security firm Zimperium zLabs identified similar dangerous Trojans like Arsink, which impersonates popular brands including WhatsApp and TikTok to evade detection.

ACTIVITY FEED

Recent activity

6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

6 SOURCESView more in app

cysecurity newsNews

May 23, 2026

Millions of Devices at Risk: New Trojan Monitors Smartphones - CySecurity News - Latest Information Security and Hacking Incidents

Android trojan that impersonates popular brands to trick users into installing malicious apps, enabling theft of sensitive data and remote compromise of devices.

the hacker newsNews

Mar 20, 2026

Google Adds 24-Hour Wait for Unverified App Sideloading to Reduce Malware and Scams

Android malware family detected in the wild; the content notes an improved variant called SURXRAT.

the hacker newsNews

Mar 12, 2026

Six Android Malware Families Target Pix Payments, Banking Apps, and Crypto Wallets

Referenced as the predecessor framework/family that SURXRAT is assessed to improve upon.

hackreadNews

Feb 24, 2026

New ZeroDayRAT Malware Claims Full Monitoring of Android and iOS Devices

Mobile malware family noted for leveraging Google Apps Script infrastructure.

+2 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping4

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.