New ArcticRAT Malware Uses Fake VPN Connections to Evade Google Play Protect During Installation

Gbhackers •Mayura Kathir • November 13, 2026

ArcticRAT, an Android remote access trojan (RAT). It started as spyware aimed at users of 11 cryptocurrency apps and has grown into a modular, AI-assisted tool for full device takeover. The most notable change is that its operators now send stolen SMS and app data to a large language model (LLM) for automated financial triage. […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

ArcticRAT Malware Evolves into AI-Powered Android Threat Zimperium has identified ArcticRAT, an Android remote access trojan (RAT) that has evolved from targeting cryptocurrency apps to a broader threat capable of stealing banking information and controlling devices. The malware employs sophisticated techniques, including hidden VNC and black screen overlays, to operate unnoticed while exfiltrating sensitive data. It utilizes AI, specifically xAI's Grok, to analyze stolen SMS messages for financial codes and credentials. The campaign has seen the deployment of 78 unique malware samples, with 42 droppers and 36 payloads identified. ArcticRAT's distribution methods include fake Google Play listings and malvertising, making it a significant threat to both individual and corporate users. The malware's capabilities include credential theft, device manipulation, and surveillance, marking a dangerous escalation in mobile threats. As of November 12, 2026, the malware is still actively being developed and exploited. 6 sources 68

Extracted Entities

New ArcticRAT Malware Uses Fake VPN Connections to Evade Google Play Protect During Installation

The full story

Extracted Entities

Attack Types (1)

Malware (1)

Platforms (1)