ArcticRAT evolves into an AI powered Android spying tool

ArcticRAT, long known as an Android cryptocurrency stealer, has evolved into a sophisticated remote access Trojan (RAT) that can take full control of infected devices, harvest sensitive information, and use artificial intelligence to identify valuable financial data. Researchers at Zimperium describe a “dangerous escalation” in the mobile threat landscape, with ArcticRAT 2.0 enabling real-time interaction with compromised devices rather than relying solely on pre-programmed actions.

The latest variants conceal attacker activity with a completely black, un-dismissible screen overlay and employ large language model (LLM) services to sift through stolen data, such as text messages, to pinpoint banking, cryptocurrency, and trading information.

The new capabilities extend well beyond theft of credentials. ArcticRAT now offers remote device control and surveillance, credential and keystroke theft, screen capture and live streaming, microphone monitoring, and access to SMS messages, contacts, and call logs. It can even steal or alter device lock-screen credentials.

Since July, Zimperium analysts identified 78 unique malware samples, 42 dropper samples, 36 payloads, and 21 IP addresses used for command-and-control, along with 129 distinct commands for remote control, data exfiltration, and manipulation of device functions.

The operators use malvertising, smishing, and third-party forums to direct users to malicious sites where the malware is embedded, with some deliveries occurring from Amazon Web Services storage buckets and a landing page impersonating Google Play to deceive targets. ArcticRAT first collects device information—location, battery status, screen state, Wi‑Fi, and active apps—before the attackers choose which functions to activate.