ArcticRAT Malware Evolves into AI-Powered Android Threat

• •ArcticRAT has evolved from crypto-targeted spyware to a full-fledged RAT with AI capabilities.
• •The malware uses black screen overlays to conceal its activities while stealing sensitive information.
• •Zimperium identified 78 unique malware samples, indicating a broad and ongoing campaign.

Zimperium has identified ArcticRAT, an Android remote access trojan (RAT) that has evolved from targeting cryptocurrency apps to a broader threat capable of stealing banking information and controlling devices. The malware employs sophisticated techniques, including hidden VNC and black screen overlays, to operate unnoticed while exfiltrating sensitive data. It utilizes AI, specifically xAI's Grok, to analyze stolen SMS messages for financial codes and credentials. The campaign has seen the deployment of 78 unique malware samples, with 42 droppers and 36 payloads identified. ArcticRAT's distribution methods include fake Google Play listings and malvertising, making it a significant threat to both individual and corporate users. The malware's capabilities include credential theft, device manipulation, and surveillance, marking a dangerous escalation in mobile threats. As of November 12, 2026, the malware is still actively being developed and exploited.