ArcticRAT Evolves into AI-Powered Android RAT, Stealing Banking Data and Credentials
Hari 
Zimperium’s zLabs team has detailed ArcticRAT, an Android remote access trojan that began as a spyware operation against users of 11 cryptocurrency apps. It has since grown into a modular platform for full device takeover.
The name comes from early package identifiers such as net.iceflow.arcticlink and net.frostlink.iceforge. zLabs catalogued 78 malware samples, 42 droppers, 36 payloads and 129 distinct C2 commands. The pivotal shift came around mid-July 2026, when operators wired a Large Language Model API into the exfiltration pipeline.
ArcticRAT
Delivery relies on malvertising, smishing and third-party forums that route victims to landing pages impersonating Google Play. Droppers masquerade as Amazon, TikTok, file managers and crypto apps, and some payloads were served from AWS buckets.
The dropper requests VPN service privileges and establishes a null-routing tunnel to blind Play Protect telemetry. It then decrypts the secondary payload from its assets folder, installs it through the native session installer and tears the tunnel down.
Once Accessibility Services are granted, ArcticRAT traverses the view tree to harvest credentials and OTPs, in a pattern similar to the YuanKong Android RAT’s Accessibility-driven control and Wireless Debugging pairing.
The C2 channel runs over raw TCP sockets, with port 9999 for the main session, 8888 for HVNC, 5055 for screen casting and 5000 for microphone streaming. Initial DEVINFO telemetry covers battery level, screen state, Wi-Fi status and wallpaper, which doubles as a sandbox check. The server then decides which routines to push based on the victim profile.
Credential theft goes beyond keylogging, which is cached as date-stamped JSON under /storage/emulated/0/config/System/. The <Phsing> directive launches a localized lock-screen overlay that captures the PIN, pattern or password.
Captured values are written to phish_logs.txt and verified silently with the OS-level command locksettings verify. This resembles how the GhostBat RAT abuses transparent accessibility overlays to record UPI PIN taps, although ArcticRAT favors full-screen spoofing. During HVNC sessions, a black-screen overlay with brightness set to zero hides the attacker’s activity from the victim.
The most consequential addition is the <xAI_API> directive. The C2 server pushes an API key to the device, which queries the grok-4.20-0309-non-reasoning model with hardcoded prompts. One prompt filters installed packages for banking, crypto and trading apps.
Another scans SMS content for OTPs, balance changes and transfer notices, then estimates the victim’s financial standing and returns structured JSON. Results are cached under /config/AI_DATA/ and exfiltrated on <Get_AI_ANA_Data>.
The same pattern of outsourcing victim triage to a model appears in the VOLTA infostealer, which uses Claude AI to rank victims by resale value.
Recent builds also pair with Android 11+ Wireless Debugging for privilege escalation. The malware uses NsdManager to resolve the _adb-tls-pairing._tcp service, completes the TLS handshake with an attacker-supplied code and gains a shell.
From there it can force-enable its own Accessibility Service and rewrite lock credentials with locksettings set-pin or set-password. Its ransomware screen is purely theatrical, with an endless progress bar and no actual encryption.
Defenders should hunt for the VPN null-route behavior, non-standard TCP ports, MediaProjection abuse during financial sessions and outbound calls to api.x.ai from non-browser apps. They should also use runtime protection that flags overlay injection and screen sharing in banking apps.
Site: Thecyberdef.com
Follow TheCyberDef on Google News, LinkedIn & X for the latest cybersecurity updates. Stay informed.
About the Author
Kiran