Android phones infected with a trojan called ArcticRAT can be operated by a stranger while the owner sees nothing but a dead-looking screen. Security firm Zimperium, which named it, says the newest versions also hand stolen text messages to an AI model that picks out the financially useful ones.
It reaches people through fake download pages, most often one that copies Google Play, and through ads, text messages and forum links. Disguises seen in the samples include Amazon, TikTok, file managers and crypto apps.
The zLabs research describes a family that started as spyware for owners of 11 crypto apps and has since become a general remote-access trojan. The control code alone holds 129 separate commands, and the servers behind it use 21 addresses. In all, 78 samples turned up, split between 42 droppers and 36 payloads. The AI step first appeared in samples from around mid-July 2026.
The first app a victim installs is only a dropper. It asks for VPN permission, which it uses to cut the phone’s network traffic so Google Play Protect cannot report what is happening, then shows a fake installer, unpacks the real payload and drops the VPN again. The payload then asks for Accessibility access.
With that, the attacker gets a hidden virtual screen that can be driven remotely. During those sessions ArcticRAT draws a black, undismissable layer over the display and turns the brightness to zero, so the owner sees what looks like a locked or powered-off phone while the attacker taps through banking apps and approves permission prompts.
The AI part works through a command that hands the phone an API key for xAI’s Grok. Zimperium saw the model grok-4.20-0309-non-reasoning in use. The first instruction has the model sort the phone’s installed apps and flag anything that handles banking, crypto or trading. The second goes through the stolen SMS: it discards adverts, keeps login codes, account movements and payment alerts, and guesses how well off the owner is. The answer is packaged as structured data for the operators.
The malware also fakes a lock screen to capture the phone’s PIN, pattern or password, and a cheaper trick, a fake ransomware screen with an endless progress bar, but it does not encrypt any files. Recent builds go further and abuse Android’s Wireless Debugging to switch on their own Accessibility access, check a stolen PIN against the system, and even set a new PIN so the owner is locked out.
Zimperium’s advice is mostly aimed at companies using its own products. For ordinary users the practical points are in the infection route: install apps only from the real Play Store, and treat any request for VPN, Accessibility or install-unknown-apps permission from an app that does not need it as a stop sign. Most of the control servers sit in Hong Kong (about two thirds), with Germany next at about one fifth.
