ArcticRAT Android Malware Uses Hidden VNC to Control Smartphones While Showing Victims a Black Screen

Cybersecuritynews •Tushar Subhra Dutta • November 13, 2026

A new Android remote access trojan called ArcticRAT can take full control of a phone while the owner sees only a black screen. The device looks locked or switched off, but an attacker is opening banking apps, approving permissions and stealing data in the background. The malware began as a small spyware tool aimed at […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

ArcticRAT Malware Evolves into AI-Powered Android Threat Zimperium has identified ArcticRAT, an Android remote access trojan (RAT) that has evolved from targeting cryptocurrency apps to a broader threat capable of stealing banking information and controlling devices. The malware employs sophisticated techniques, including hidden VNC and black screen overlays, to operate unnoticed while exfiltrating sensitive data. It utilizes AI, specifically xAI's Grok, to analyze stolen SMS messages for financial codes and credentials. The campaign has seen the deployment of 78 unique malware samples, with 42 droppers and 36 payloads identified. ArcticRAT's distribution methods include fake Google Play listings and malvertising, making it a significant threat to both individual and corporate users. The malware's capabilities include credential theft, device manipulation, and surveillance, marking a dangerous escalation in mobile threats. As of November 12, 2026, the malware is still actively being developed and exploited. 6 sources 68

Extracted Entities

ArcticRAT Android Malware Uses Hidden VNC to Control Smartphones While Showing Victims a Black Screen

The full story

Extracted Entities

Attack Types (1)

Malware (1)

Platforms (1)

Tools (1)