Medium 4 Hunt LeadsIOCs ArcticRAT Zimperium zLabs

ArcticRAT Has Grok Read Your Texts to Find Your Money

Zimperium says the ArcticRAT Android trojan now sends stolen SMS and app lists to xAI's Grok to find bank codes and balances, and can abuse Wireless Debugging to reset your lock screen.

ThreatRoundup · Nov 14, 2026 · 15 min read

An Android trojan that started out spying on users of 11 crypto apps now asks an AI model to read its victims’ text messages and work out how much money they have. Zimperium’s zLabs says ArcticRAT has grown into a full remote-access tool with hidden remote control, a fake lock screen that steals your PIN or pattern, a fake ransomware screen, and, since about mid-July 2026, a command that sends installed-app lists and stolen SMS to xAI’s Grok API to pick out bank, crypto and trading apps, one-time codes and balance changes. Zimperium counted 78 samples, 42 droppers and 129 commands, with C2 servers mostly in Hong Kong.

For defenders

Delivery: malvertising, smishing and forum links lead to fake Google Play pages (and some AWS buckets) offering apps that pose as Amazon, TikTok, file managers or crypto wallets. The dropper asks for VPN permission and null-routes all traffic, which Zimperium says blinds Google Play Protect while it decrypts and installs the real payload, then drops the VPN. Early package names include net.iceflow.arcticlink and net.frostlink.iceforge.

Control: once Accessibility is granted it talks raw TCP to its C2: main channel on port 9999, hidden VNC on 8888, microphone on 5000, screen cast on 5055 and remote-control redraw on 5058 (T1571 (Non-Standard Port)). It logs keystrokes into date-stamped JSON under /storage/emulated/0/config/, throws up a black “screen is locked” overlay while operators work, and checks stolen PINs silently with locksettings. Newer builds pair with Android’s Wireless Debugging (ADB over Wi-Fi) to get a privileged shell that can enable their own Accessibility access or clear and reset the lock screen, locking the owner out.

The AI part: the <xAI_API> command pushes an API key to the phone, which then queries Grok (Zimperium saw the grok-4.20-0309-non-reasoning model) with built-in prompts that filter finance apps and pull OTPs, balance updates and transfer notices from SMS into JSON for exfiltration. Zimperium maps everything to the ATT&CK Mobile matrix and published C2 IPs plus MD5 hashes in its IOC repository. No CVE: it relies on the victim granting permissions.

Network

91.92.34[.]13, 167.148.195[.]29, 192.238.202[.]57, 192.238.254[.]27, 192.238.176[.]41
45.192.208[.]10, 45.192.208[.]182, 45.192.209[.]220, 45.192.210[.]66
85.11.161[.]20, 85.11.161[.]30, 85.11.161[.]34, 85.11.161[.]55, 85.11.161[.]76
108.187.44[.]146, 2.27.160[.]3, 212.81.47[.]172, 93.152.205[.]71, 93.152.223[.]55
(C2 on TCP 9999, 8888, 5000, 5055, 5058)

Host

Packages: net.iceflow.arcticlink, net.frostlink.iceforge
/storage/emulated/0/config/ (System/, Click_data/, screenshot/, AI_DATA/)
/storage/emulated/0/config/phis_info/phish_logs.txt

What it means for you

If you only install apps from the real Google Play Store, this one is unlikely to reach you. The danger is a link, text or ad that takes you to a page that looks like Play and offers a download. Once you give such an app “Accessibility” permission, it can see and press everything on your screen, read your texts, including bank codes, and lock you out of your own phone.

Do this now

Install apps only from Google Play, and never from a link in a text, ad or forum post.
Be very suspicious of any app that asks for Accessibility permission or to set up a VPN during install.
Leave Wireless Debugging (Developer options) switched off unless you are a developer actively using it.
Use an authenticator app or passkeys instead of SMS codes for banking and crypto where you can.

Source article: Uncovering ArcticRAT: The Evolution from Targeted Crypto-Stealer to AI-Powered Android RAT
Publisher: Zimperium zLabs
Published: Nov. 12, 2026
URL: https://zimperium.com/blog/arcticrat-ai-powered-android-rat

Executive Summary

Zimperium’s zLabs tracks ArcticRAT, an Android malware family named after package names in its early samples (net.iceflow.arcticlink, net.frostlink.iceforge); no operator is named and no other vendor aliases are reported, though Zimperium notes its AI features mirror those in the RatHat family it covered earlier. ArcticRAT began as targeted spyware against users of 11 cryptocurrency apps and, across versions 6.3 to 6.5.2, became a modular remote-access trojan: Zimperium catalogued 78 samples (42 droppers, 36 payloads), 21 C2 addresses (two-thirds in Hong Kong, about 20% in Germany) and 129 commands. Victims arrive through malvertising, smishing or forum links at fake Google Play pages or AWS-hosted downloads posing as Amazon, TikTok, file managers or crypto apps. The dropper requests VPN-service permission and null-routes all traffic to blind Google Play Protect while it decrypts and installs the payload through the session installer, then tears the VPN down. After the victim grants Accessibility, the payload sends a DEVINFO profile (battery, screen state, Wi-Fi, wallpaper) over raw TCP port 9999, and the C2 then chooses modules: hidden VNC over port 8888 using MediaProjection and a virtual display, screen casting on 5055, remote-control redraw on 5058, microphone streaming on 5000, keylogging and screenshots staged under /storage/emulated/0/config/, a fake lock screen (<Phsing>) that captures the PIN, pattern or password and verifies it with locksettings verify, a black overlay that hides operator activity, a fake ransomware screen, SMS sending and call control, and self-removal. Recent builds abuse Android 11+ Wireless Debugging by discovering the _adb-tls-pairing._tcp mDNS service and pairing with an operator-supplied code to gain an ADB shell that can enable Accessibility or clear and reset the device lock. Since about mid-July 2026 the <xAI_API> command delivers an API key so the device itself queries xAI’s Grok API with hardcoded prompts that pick finance apps from the installed list and extract one-time codes, balance changes and transfer notices from SMS, caching the JSON results under /storage/emulated/0/config/AI_DATA/ for exfiltration. The objective is financial fraud and full device takeover. Hunt leads, false positive expectations and indicators are detailed below; Zimperium published C2 addresses and MD5 hashes but no YARA or Sigma rules.

ATT&CK chain (Zimperium’s Mobile mapping): Initial Access → Execution → Privilege Escalation → Defense Evasion → Persistence → Credential Access → Discovery → Collection → Command and Control → Exfiltration → Impact

Hunt Lead Grid

Hunt Lead Level	Hunt Lead Name	ATT&CK	Risk of False Positives
1 (Junior)	ArcticRAT C2 Address Sweep	T1571 (Non-Standard Port), T1041 (Exfiltration Over C2 Channel)	Low. The 19 public addresses come from Zimperium’s C2 list; several sit in hosting ranges shared with other customers, so the lead anchors on exact IPs combined with the malware’s ports.
1 (Junior)	ArcticRAT Package and Hash Sweep in Mobile Inventory	Enterprise: not mapped (mobile app artifact); Zimperium’s Mobile mapping: “Deliver Malicious App via Other Means” and “Masquerading: Match Legitimate Name or Location” (mapping per source article)	Low. MD5s and package names are specific to the samples; the lead matches exact values from Zimperium’s repository only.
2 (Pro)	Sideloaded App with Accessibility, VPN and Wireless Debugging	Enterprise: not mapped (Android device behavior); Zimperium’s Mobile mapping: “Abuse Accessibility Features”, “Impair Defenses”, “Lockscreen Bypass” and “Exploitation for Privilege Escalation” (mapping per source article)	Medium. Password managers, accessibility tools and VPN apps legitimately request these permissions; the lead anchors on the combination in one sideloaded app, plus Wireless Debugging on a non-developer device.
3 (Elite)	Multi-Port Raw TCP Fan-Out and LLM API Calls from Phones	T1571 (Non-Standard Port), T1041 (Exfiltration Over C2 Channel)	High. Phones make many connections and AI apps legitimately call LLM APIs; the lead needs per-device baselines, correlation of several non-standard ports to one address, and an app-level view of which process called the AI API.

ArcticRAT C2 Address Sweep

Zimperium’s c2.csv lists the servers seen across all variants; after removing two private 10.x addresses, the public C2s are 91.92.34[.]13, 167.148.195[.]29, 192.238.202[.]57, 192.238.254[.]27, 192.238.176[.]41, 45.192.208[.]10, 45.192.208[.]182, 45.192.209[.]220, 45.192.210[.]66, 85.11.161[.]20, 85.11.161[.]30, 85.11.161[.]34, 85.11.161[.]55, 85.11.161[.]76, 108.187.44[.]146, 2.27.160[.]3, 212.81.47[.]172, 93.152.205[.]71 and 93.152.223[.]55. The malware hardcodes its ports in the configuration block: 9999 for the main channel (mainport), 8888 for hidden VNC, 5000 for microphone streaming, 5055 for screen casting (sc_cast_serverPort) and 5058 for the redraw channel (scren_redrport), all over raw TCP sockets rather than HTTP. The detection logic is a retrospective search of firewall, NetFlow, DNS-less connection logs and mobile security telemetry for any device connecting to these addresses, with a higher rating when the destination port is one of the five above.

Use corporate Wi-Fi and VPN firewall logs, NetFlow, mobile threat defense or MDM network telemetry, and carrier or secure-web-gateway logs if managed phones are tunnelled. Sweep back to at least June 2026, since the AI-capable phase began in mid-July. Most phones are only visible when they are on corporate Wi-Fi or a full-tunnel VPN, so a clean result is not proof of absence. Block the addresses at the egress, but expect the operators to add servers; the port pattern is the more durable signal. Any connection from a managed or BYOD device to these addresses should trigger device quarantine, a factory reset and a reset of every account used on that phone, including SMS-based MFA enrolments.

Hunt Lead Level: 1 (Junior Analyst)

ATT&CK: Command and Control → T1571 (Non-Standard Port); Exfiltration → T1041 (Exfiltration Over C2 Channel) (Enterprise equivalents of Zimperium’s Mobile “Non-Standard Port” and “Exfiltration Over C2 Channel”)

Sources: “Uncovering ArcticRAT: The Evolution from Targeted Crypto-Stealer to AI-Powered Android RAT”, Zimperium zLabs, Nov. 12, 2026, https://zimperium.com/blog/arcticrat-ai-powered-android-rat (source article); “2026-11-ArticRAT” IOC folder (c2.csv), Zimperium, Nov. 2026, https://github.com/Zimperium/IOC/tree/master/2026-11-ArticRAT (source article’s IOC repository)

ArcticRAT Package and Hash Sweep in Mobile Inventory

Zimperium published 42 dropper and 36 payload MD5 hashes (droppers.csv and payloads.csv) and names the early package identifiers net.iceflow.arcticlink and net.frostlink.iceforge. Droppers impersonate Amazon, TikTok, generic file managers and crypto apps with genuine brand icons, are downloaded from fake Google Play pages or AWS buckets rather than the Play Store, and install the payload as a second package from their encrypted assets folder. The detection logic is to compare the MD5 of every APK in your mobile inventory, mobile threat defense app list or download-gateway logs against the 78 published hashes, to search for the two package names, and to flag any app with a big-brand name (Amazon, TikTok) whose installer source is not the Play Store or whose signing certificate does not match the brand’s.

Use MDM or mobile threat defense application inventories (package name, installer source, signing certificate, APK hash), secure web gateway logs for .apk downloads, and email or SMS security logs for links to fake Play pages. Sweep the whole inventory now and then on every new enrolment. Hash matching will miss new builds, since the family changes quickly, which is why the installer-source and certificate check matters more. Blocking AWS storage domains outright would break legitimate services; block the specific bucket URLs if you find them instead. A match means a compromised device: isolate it from corporate resources, wipe it, and rotate credentials and MFA for every account used on it.

Hunt Lead Level: 1 (Junior Analyst)

ATT&CK: Enterprise: not mapped (insufficient fit for a mobile app artifact). Zimperium’s Mobile mapping: Initial Access “Deliver Malicious App via Other Means”; Defense Evasion “Masquerading: Match Legitimate Name or Location” and “Download New Code at Runtime” (mapping per source article)

Sources: Zimperium zLabs (above), source article; Zimperium IOC repository droppers.csv and payloads.csv (above)

Sideloaded App with Accessibility, VPN and Wireless Debugging

ArcticRAT’s dropper asks for VPN-service privileges and creates a VPN session named VlockPJO that routes all IPv4 and IPv6 traffic into a dead end, shows a fake installation screen in a WebView, installs the payload, then drops the VPN. The payload then needs Accessibility, which it uses to scrape screens, auto-approve permissions, block uninstallation and drive hidden VNC; it registers boot, SMS and screen-off receivers and runs foreground services with invisible notifications to stay alive. Newer builds look for the _adb-tls-pairing._tcp mDNS service, resolve the pairing port with NsdManager and pair with a six-digit code the operator types in, giving an ADB shell that runs dumpsys lock_settings, force-enables Accessibility, and runs locksettings verify, clear or set-pin, set-password and set-pattern. On disk it stages data under /storage/emulated/0/config/ (System/, Click_data/, screenshot/, AI_DATA/ and phis_info/phish_logs.txt). The detection logic, implemented in mobile threat defense or MDM compliance rules, is to flag any app not from the Play Store that holds an enabled Accessibility service together with VPN-service or overlay permissions, any non-developer device with Wireless Debugging enabled or paired, and the presence of the /storage/emulated/0/config/ staging tree.

Use mobile threat defense telemetry, Android Enterprise or MDM compliance data (installed apps, granted permissions, developer options state), and Play Protect status reports where available. Run it continuously rather than as a one-off sweep, since the malware can switch Accessibility back on through ADB. Legitimate accessibility tools, password managers and corporate VPN clients will match single conditions, so require the combination and the sideload source, and allowlist approved apps by package name plus signing certificate. Disabling Developer options by policy on managed devices is a sound control; relying on Play Protect alone is not, since the dropper is built to blind it during install. A device that matches should be quarantined and wiped, and the user’s SMS-based codes treated as exposed.

Hunt Lead Level: 2 (Pro)

ATT&CK: Enterprise: not mapped (Android device behavior). Zimperium’s Mobile mapping: Execution “Abuse Accessibility Features”; Defense Evasion “Impair Defenses”, “Lockscreen Bypass”, “Impair Defenses: Device Lockout” and “Hide Artifacts”; Privilege Escalation “Exploitation for Privilege Escalation” (wireless ADB); Persistence “Broadcast Receivers” and “Foreground Persistence”; Credential Access “Input Capture: GUI Input Capture” (mapping per source article)

Sources: Zimperium zLabs (above), source article

Multi-Port Raw TCP Fan-Out and LLM API Calls from Phones

Because ArcticRAT separates its functions across ports, an active session produces a recognizable shape: a long-lived raw TCP connection to port 9999 on one server, then, when the operator picks modules, parallel connections from the same device to the same address on 8888 (hidden VNC, JPEG frames with a Header|Timestamp|Size|Width|Height structure), 5055 (screen cast), 5058 (redraw) and 5000 (microphone), carrying far more upstream than downstream data. When the <xAI_API> command fires, the device itself makes HTTPS requests to api.x.ai /v1/chat/completions with an operator-supplied key, and later sends the cached AI_DATA JSON back over the C2 socket when <Get_AI_ANA_Data> arrives. The detection logic correlates, per device, three or more non-HTTP TCP sessions to one external address on these non-standard ports within minutes, a strongly upstream-heavy byte ratio on those sessions, and, where app-level attribution exists, an LLM API call from an app that is not an approved AI assistant.

This needs NetFlow or firewall session data with byte counts for phone subnets or tunnelled traffic, mobile threat defense app-level network attribution, and a baseline of normal phone traffic over two to four weeks. Do not block api.x.ai or other LLM APIs for the whole fleet on the strength of this report, since legitimate apps use them; the anchor is the multi-port shape to one address and the calling app. The lead generalizes beyond ArcticRAT to other Android RATs that split VNC, audio and command channels across ports, and to mobile malware that offloads analysis to commercial AI. A match should be escalated as an active device takeover: cut the device’s network access, alert the user out of band, and freeze high-value accounts the user reaches from that phone.

Hunt Lead Level: 3 (Elite)

ATT&CK: Command and Control → T1571 (Non-Standard Port); Exfiltration → T1041 (Exfiltration Over C2 Channel) (Enterprise equivalents; Zimperium’s Mobile mapping adds “Video Capture”, “Audio Capture” and “Protected User Data: SMS Messages”)

Sources: Zimperium zLabs (above), source article

Hash Appendix

ArcticRAT droppers

MD5 values come from Zimperium’s IOC repository linked from the source article (droppers.csv). Zimperium published no SHA1 or SHA256 values and no file names per hash; OTX AlienVault and VirusTotal were not queried for these 78 samples in this report.

MD5s

09b25e0cf98f0808debb83ed922d5361  # ArcticRAT dropper APK
ac03196b8bfcfbce4f81fd888aa999bf  # ArcticRAT dropper APK
51e366a40753f4f8f3bef083269180a0  # ArcticRAT dropper APK
91e96c6c3945c2ada59f0c84ce3aee83  # ArcticRAT dropper APK
266b71e7b5862abd152f169b1a7baacf  # ArcticRAT dropper APK
2a2fe9e6aa56cfda425d95b044d7e60e  # ArcticRAT dropper APK
82067f8bb83fc12d2b58114c010ea0fa  # ArcticRAT dropper APK
bbd28893f041e07d00f729da57cf8745  # ArcticRAT dropper APK
18cccd5624e3c00939ac387751d280c2  # ArcticRAT dropper APK
f6d576ced07012fab440a15c125fb021  # ArcticRAT dropper APK
00cbefe8aa87b0599cd0de34f0dfc447  # ArcticRAT dropper APK
dfa347034466d99d6efa5c9d1084a9b2  # ArcticRAT dropper APK
07a084c1b136b3545550322dd45ff11d  # ArcticRAT dropper APK
5666b120cd2abcfad06a4d1c562b9217  # ArcticRAT dropper APK
fcb05777a76faca5e6d144e3524cdc56  # ArcticRAT dropper APK
cf0a981dffcb16782f9b5403f809b891  # ArcticRAT dropper APK
9384d16ef4806662bd4027cde439658d  # ArcticRAT dropper APK
42378616fecc1e86ad1f367f7bc14dbe  # ArcticRAT dropper APK
1fb3e41ada964414965bd90306eb5c4d  # ArcticRAT dropper APK
fef9c5cb978be723fb8c0d1b7dc524ca  # ArcticRAT dropper APK
39d28efe824a1d9161eda990a4c6a043  # ArcticRAT dropper APK
ea9ab22ccc74c9c6905ddc420d916433  # ArcticRAT dropper APK
3ff16b84968ddac0926cddd36e76e14e  # ArcticRAT dropper APK
b1e822516249192919a12b542d64a878  # ArcticRAT dropper APK
5647e785a944cf83b2e42d222489317c  # ArcticRAT dropper APK
ed5f7c2c1fe399da98978fc0527dbc9d  # ArcticRAT dropper APK
f7d295e9693fd54a4eb32b456da61f0e  # ArcticRAT dropper APK
968ef01c5df1b3f2a5182dfd0b031228  # ArcticRAT dropper APK
d5f033d3c21646f71440f0a1b583e75d  # ArcticRAT dropper APK
7633cc23b8164e42800cb7c275c1258f  # ArcticRAT dropper APK
2181adbeba7be6b87825058287b9d2c4  # ArcticRAT dropper APK
4dad280b2f878653f0215864304de2c7  # ArcticRAT dropper APK
409649fd400889edc8a8a5dad4540766  # ArcticRAT dropper APK
cbb308c8cdbca59b9ded3efd552e0ccd  # ArcticRAT dropper APK
b8c5884c672d32a9d9ef3d5da0d6c6a5  # ArcticRAT dropper APK
4e10bfdc0ca53cfad93cbde637070127  # ArcticRAT dropper APK
6495be64978a1008d12e2cb6e2871f26  # ArcticRAT dropper APK
7eed834508467b115bbb94814419cfdf  # ArcticRAT dropper APK
a1ccb4dd9652e2849e8160988f6ae9bf  # ArcticRAT dropper APK
7332a58dd20f11d1890d8e871a66aaab  # ArcticRAT dropper APK
811cdc18b64cbee97af9bd11eb76835a  # ArcticRAT dropper APK
6731b73e7862bb5ea41585145f129a3c  # ArcticRAT dropper APK

SHA1s / SHA256s: (not available) # ArcticRAT dropper APKs

ArcticRAT payloads

MD5 values come from Zimperium’s IOC repository (payloads.csv); SHA1 and SHA256 were not published and OTX AlienVault and VirusTotal were not queried.