Security firm Zimperium has identified a new Android remote-access trojan named ArcticRAT. The malware, which is currently under active development, uses the xAI Grok model to process stolen SMS messages. By leveraging the Grok API, the trojan extracts sensitive data such as one-time passcodes and financial transaction alerts from intercepted texts.
Originally designed as spyware targeting 11 cryptocurrency applications, ArcticRAT has evolved into a modular threat. The integration of AI capabilities occurred in mid-July 2026. Beyond text analysis, the malware employs hidden virtual network computing, deceptive overlays, and unauthorized use of Android Accessibility Services to control infected devices.
Zimperium researchers have documented 78 unique samples of the malware, consisting of 42 droppers and 36 payloads. The investigation also linked the operation to 21 command-and-control IP addresses, primarily located in Hong Kong and Germany. The findings were officially disclosed by the company on November 12, 2026.
The use of AI in ArcticRAT mirrors trends seen in other recent threats, such as the RatHat malware identified in September 2026. Zimperium notes that the malware accesses Grok through the standard xAI API, highlighting how general-purpose AI models can be integrated into criminal workflows without triggering immediate security alerts.
