ArcticRAT: Android users — crypto stealer evolved into AI-powered RAT with full device control and financial data profiling
Severity: high · Patch status: no-fix-needed · Since 2026-11-13
Zimperium researchers report that ArcticRAT, previously an Android cryptocurrency stealer targeting 11 crypto apps, has evolved into a full remote access Trojan with AI-assisted data analysis. Version 2.0 gives attackers real-time remote device control via abused Android Accessibility Services, keystroke and credential theft, screen capture and streaming, microphone monitoring, SMS/contact/call-log theft, and lock-screen credential manipulation, hidden behind a black, un-dismissible screen overlay. It connects to xAI's Grok API to automatically sort stolen SMS and app data, identify banking, crypto and trading apps, extract OTPs and transaction alerts, and estimate victims' financial standing. Distribution uses malvertising, smishing, forums, fake Google Play landing pages, and AWS buckets. No vendor patch applies; defense relies on on-device AI threat detection and permission controls.
What to do
- Block known C2 IP addresses and associated dropper/payload samples via mobile threat defense
- Deploy AI-powered on-device threat detection capable of flagging malicious overlays and screen-sharing activity
- Restrict Android app installation sources and audit Accessibility Services permissions on managed devices
- Warn users about smishing and fake Google Play pages; forbid installing apps from third-party links
- Monitor for anomalous device behavior such as screen streaming, overlay abuse, and lock-screen changes
Sources
All live incidents on Threat Watch