ArcticRAT Adds AI-Assisted Financial Theft and Hidden Android Device Control

Zimperium’s zLabs identified 78 samples of ArcticRAT, an Android remote access trojan that evolved from spyware targeting users of 11 cryptocurrency applications into a broader financial theft and surveillance platform supporting 129 control commands. Distributed through brand-impersonating applications and fake Google Play pages, its droppers temporarily suppress network traffic through a VPN to interfere with Google Play Protect telemetry during installation. Researchers first observed large language model integration in samples analyzed around mid-July 2026: the malware uses the xAI API to identify financial applications and extract authentication codes, transaction details, and financial indicators from stolen SMS messages.

ArcticRAT abuses Accessibility Services, hidden virtual displays, and black overlays to let attackers operate phones while victims believe they are locked or switched off. It can steal credentials and uses local Wireless ADB pairing to obtain a privileged shell, potentially enabling attackers to grant Accessibility access, remove the lock screen, or change the device PIN. It also displays ransomware-style demands, although Zimperium found no file encryption. Organizations managing Android devices should restrict untrusted application installation, monitor unauthorized Accessibility access and Wireless Debugging, and avoid treating a black screen as evidence that a device is inactive.