ArcticRAT Uses Grok to Analyze Stolen Texts for Crypto Account Data

Security firm Zimperium disclosed Thursday, Nov. 12, that ArcticRAT uses xAI’s API to have Grok analyze text messages and installed-app lists on infected Android phones, adding a way to identify login codes and transaction alerts to malware that began by targeting cryptocurrency apps.

ArcticRAT is an Android remote-access trojan (RAT), a type of malware that gives an operator remote access to a device. It began as spyware aimed at 11 cryptocurrency applications before expanding into a modular tool. ArcticRAT has 78 identified samples: 42 droppers and 36 payloads. Versions with the AI integration appeared around mid-July 2026, and development remains active.

On infected devices, prompts ask Grok to identify banking, cryptocurrency and trading apps from the installed-app list. Other instructions tell the model to inspect messages for one-time passcodes (OTPs) and transaction alerts. Responses are returned in a structured JSON format.

Malvertising and SMS phishing can direct users to malicious downloads. ArcticRAT is distributed through fake Google Play listings that imitate legitimate apps.

After installation, ArcticRAT abuses Android Accessibility Services, which are designed to help users interact with their devices, to read screens and activate controls. It also uses Hidden VNC (HVNC), enabling an attacker to control the screen while concealing activity from the phone’s owner. Deceptive overlays and fake lock screens add other ways to mask activity on the device.

ArcticRAT samples were tied to 21 command-and-control (C2) IP addresses, most of them in Hong Kong and Germany. The malware remains under active development.

The prompts reach beyond cryptocurrency apps to banking and trading services. For crypto users, the combination matters because the infection identifies financial apps and searches messages for information tied to them. One-time passcodes can be used during login, while transaction alerts can show account activity. Together, those features let the malware locate relevant services and collect related message content.