Malware

ArcticRAT

Tracked since Nov 12, 2026 · Updated today

Trending this week#68of 30,097 malware families

Mention activity · 30 days

7 mentions · peak 4 in a dayToday

Vulns0Associated

Actors0Associated

ATT&CK0Techniques

IOCs0Tracked

Type: RAT
Capabilities: Credential theftKeyloggingExfiltrationPersistencePrivilege escalationDefense evasionReconnaissanceExtortion
Delivery: SmishingMalvertisingLanding page
Platforms: Android

ArcticRAT is an Android remote access trojan designed for covert device control, surveillance, credential theft, and financial fraud. It evolved from spyware targeting users of 11 cryptocurrency applications into a broader platform with 129 identified control commands. Distribution uses malicious advertisements, SMS messages, and third-party forums to direct users to fraudulent download sites, including pages impersonating Google Play. Malicious applications masquerade as popular consumer applications, file managers, and cryptocurrency tools.

Its dropper requests VPN permission and temporarily suppresses network connectivity to interfere with Google Play Protect during payload installation. After obtaining Accessibility access, ArcticRAT can capture inputs and screen content, automate gestures and permission interactions, and interfere with uninstallation. Hidden virtual displays support remote operation, while a non-dismissible black overlay and zero screen brightness conceal attacker activity, including interaction with banking applications. Surveillance capabilities include screenshots, microphone streaming, location tracking, and collection of contacts, SMS messages, notifications, and application activity. Collected information is staged locally and exfiltrated to command-and-control infrastructure.

ArcticRAT deploys fake lock screens to steal device PINs, patterns, and passwords. Newer variants abuse Wireless Debugging on Android 11 and later to establish a local ADB connection and obtain privileged shell access. This enables manipulation of Accessibility settings, verification of stolen unlock credentials, removal of existing screen locks, and configuration of replacement credentials that lock out the owner. Persistence mechanisms include boot and device-event receivers and foreground services with concealed notifications.

ArcticRAT integrates the xAI API to identify installed banking, cryptocurrency, and trading applications and analyze stolen messages for authentication codes, transaction notifications, and indicators of financial standing. It also displays fraudulent ransomware demands and a simulated encryption progress indicator, but does not encrypt files. Commands support application removal, self-uninstallation, and deletion of staged collection artifacts to impede forensic examination.

Is this in your environment?See whether this family's indicators match your telemetry and which of your assets are exposed to the CVEs associated with it.

Check your exposure

Activity feed

Recent activity

7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

View more in app →

cryptika blogNews · Nov 13, 2026ArcticRAT Android Malware Uses Hidden VNC to Control Smartphones While Showing Victims a Black Screen | Cryptika CybersecurityAndroid malware that evolved from spyware targeting users of 11 cryptocurrency apps into a remote access trojan with 129 control commands. Droppers impersonate legitimate apps and temporarily block network traffic using VPN permissions to interfere with Google Play Protect during payload installation. ArcticRAT abuses Accessibility access and hidden VNC to control devices beneath a black overlay. It steals messages, lock-screen credentials, keystrokes and screenshots; uses xAI to identify financial apps and analyze stolen messages; and abuses Wireless Debugging to obtain privileged ADB access. It also displays a fraudulent ransomware screen without encrypting files. Researchers identified 78 samples, including 42 droppers and 36 payloads, and 21 C2 IP addresses.Read more ↗cyber security newsNews · Nov 13, 2026ArcticRAT Android Malware Uses Hidden VNC to Control Smartphones While Showing Victims a Black ScreenAndroid malware that evolved from cryptocurrency-focused spyware into a remote access trojan with 129 commands. Its droppers temporarily block network traffic using VPN permissions to interfere with Google Play Protect during payload installation. It abuses Accessibility and hidden VNC to control devices behind a black overlay, steal data and interact with banking apps. Additional capabilities include keylogging, covert screenshots, microphone streaming, lock-screen credential phishing and a fake ransomware demand that does not encrypt files. It queries xAI to identify financial apps and analyze stolen messages for authentication codes, transactions and indicators of victim wealth. Newer versions abuse Wireless Debugging to obtain privileged ADB access, grant Accessibility permissions and manipulate device lock settings. Researchers identified 78 unique samples and 21 C2 IP addresses, with versions 6.3 through 6.5.2 indicating active development.Read more ↗zimperium blogNews · Nov 12, 2026Uncovering ArcticRAT: The Evolution from Targeted Crypto-Stealer to AI-Powered Android RATAn evolving Android malware family distributed through malicious applications impersonating trusted brands and Google Play landing pages. Its dropper temporarily suppresses network traffic using a null-routing VPN while installing an encrypted payload. ArcticRAT abuses Accessibility Services for credential theft, keylogging, UI manipulation, and remote control, with dedicated TCP channels supporting hidden screen streaming and microphone surveillance. It steals SMS messages, contacts, notifications, location data, and lock-screen credentials. Newer variants query an LLM API to identify financial applications and extract authentication codes, balances, and transaction intelligence from stolen data. It also abuses wireless ADB pairing to obtain privileged shell capabilities, manipulate accessibility settings, and remove or replace device lock credentials. Black-screen overlays conceal operations, while a fake ransomware interface demands payment without encrypting files.Read more ↗

Is this in your environment?See whether this family's indicators match your telemetry and which of your assets are exposed to the CVEs associated with it.

Check your exposure

Mallory platform

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start Free Trial Open in App ↗

IOC matchingMatch every observed IP, domain, and hash against your live telemetry.

Associated threat actorsGroups linked to this family, with evidence pinned to each claim.

Associated vulnerabilitiesCVEs linked to this family, with the reporting behind each link.

Detection signaturesYARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mappingEvery documented technique, ranked by evidence weight.

Researcher chatterReddit, Mastodon, and CTI community discussion around this family.

Malware

ArcticRAT

Tracked since Nov 12, 2026 · Updated today

Trending this week#68of 30,097 malware families

Mention activity · 30 days

7 mentions · peak 4 in a dayToday

Vulns0Associated

Actors0Associated

ATT&CK0Techniques

IOCs0Tracked

Type: RAT
Capabilities: Credential theftKeyloggingExfiltrationPersistencePrivilege escalationDefense evasionReconnaissanceExtortion
Delivery: SmishingMalvertisingLanding page
Platforms: Android

Is this in your environment?See whether this family's indicators match your telemetry and which of your assets are exposed to the CVEs associated with it.

Check your exposure

Activity feed

Recent activity

7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

View more in app →

Is this in your environment?See whether this family's indicators match your telemetry and which of your assets are exposed to the CVEs associated with it.

Check your exposure

Mallory platform

The version that knows your environment.

Start Free Trial Open in App ↗

IOC matchingMatch every observed IP, domain, and hash against your live telemetry.

Associated threat actorsGroups linked to this family, with evidence pinned to each claim.

Associated vulnerabilitiesCVEs linked to this family, with the reporting behind each link.

Detection signaturesYARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mappingEvery documented technique, ranked by evidence weight.

Researcher chatterReddit, Mastodon, and CTI community discussion around this family.