Photo: Pixabay / Pexels
An Android trojan that began by targeting crypto apps now uses Grok to sort stolen texts for login codes and financial details
Malware authors have found a new use for AI chatbots: reading your texts so they don’t have to.
Security firm Zimperium’s research team, zLabs, has disclosed ArcticRAT, an Android remote-access trojan that uses xAI’s Grok model to sift through stolen text messages for one-time passcodes and financial details. The disclosure came on November 12, 2026, and the malware is still being actively developed.
From crypto spyware to full device takeover #
ArcticRAT did not start out this ambitious. According to Zimperium, it began life as spyware aimed at 11 cryptocurrency apps.
It has since grown into a modular remote-access trojan, or RAT. The AI piece arrived in mid-July 2026. Newer versions of ArcticRAT include a component that calls xAI’s API, giving the malware access to Grok.
The job Grok performs here is unglamorous but useful to a thief. The malware feeds it stolen SMS messages and lists of installed apps. Grok then picks out the valuable bits, such as one-time passcodes (OTPs) and transaction alerts.
The results come back in structured JSON format.
How ArcticRAT hides and spreads #
Zimperium documented the use of hidden virtual network computing (VNC), which lets an attacker control the screen without the owner seeing anything happen.
The news moving money, markets, and the world—before your day starts.
Daily. Free. Join 34,000+ readers across crypto, finance, and policy.
The malware also relies on deceptive overlays and fake lock screens. It also abuses Android’s Accessibility Services, which exist to help users with disabilities interact with their phones but grant an app broad power to read screens and tap buttons on its own when misused.
As for distribution, ArcticRAT reaches victims through several familiar routes:
- Fake Google Play listings that imitate legitimate apps
- Malvertising, meaning malicious ads that lead to infected downloads
- SMS phishing, where a text message lures the target to install something
The numbers behind the campaign #
Zimperium’s researchers logged 78 unique samples of the malware. Of those, 42 were droppers and 36 were payloads.
The team also tied ArcticRAT to 21 command-and-control (C2) IP addresses. Most of that infrastructure sits in Hong Kong and Germany, according to the research.
The addition of AI functionality in mid-July 2026 marks one of the most significant updates in its development so far.
Not the first, and probably not the last #
ArcticRAT is not the first piece of malware to put AI to work against two-factor authentication. In September 2026, researchers disclosed RatHat, which also used AI to make attacks on 2FA more efficient.
What this means for crypto users and platforms #
ArcticRAT’s original targets were crypto apps, and its upgraded abilities aim squarely at the security codes that protect accounts.
There is also an uncomfortable question for AI providers. ArcticRAT reaches Grok through xAI’s API, the same front door legitimate developers use. Zimperium’s findings show how a general-purpose model can be quietly slotted into a criminal workflow without the model doing anything unusual on its own.
Zimperium describes the campaign as ongoing, with development continuing. That makes the 78 samples and 21 C2 addresses a snapshot rather than a final count.
Disclosure: This article was edited by John Chen. For more information on how we create and review content, see our Editorial Policy.