Zimperium uncovers ArcticRAT malware using xAI’s Grok to mine stolen SMS codes
Security firm Zimperium has disclosed ArcticRAT, an Android trojan that now uses xAI's Grok AI to mine stolen text messages for login codes and financial details.
The disclosure came on November 12, 2026, revealing how ArcticRAT uses Grok's API to process stolen SMS messages and identify valuable information like one-time passcodes and transaction alerts. The malware, still under active development, represents a significant evolution from its origins as spyware targeting 11 cryptocurrency applications.
From crypto spyware to RAT
Zimperium researchers documented how ArcticRAT transformed into a modular remote-access trojan (RAT). The AI integration arrived in mid-July 2026, with newer versions incorporating a component that accesses xAI's API. Grok processes stolen texts and installed app lists, returning structured data in JSON format to attackers.
Infection methods
The malware employs hidden virtual network computing (VNC) allowing attackers to control devices invisibly. It uses deceptive overlays and fake lock screens while abusing Android's Accessibility Services. Zimperium identified 78 unique samples—42 droppers and 36 payloads—distributed through fake Google Play listings, malvertising, and SMS phishing campaigns.
Global infrastructure
Researchers tied the campaign to 21 command-and-control IP addresses, primarily located in Hong Kong and Germany. The AI functionality added in July 2026 represents one of the malware's most significant updates. This follows similar AI-enhanced malware like RatHat, disclosed in September 2026, which also targeted two-factor authentication systems.
Related
