- Zimperium reports that ArcticRAT, an Android trojan, contains code that sends stolen texts and app lists to an AI model to pick out banking and crypto details.
- Zimperium says the aim is to avoid sifting stolen data by hand. It reports code, prompts and one observed API call, not how well the extraction works.
- Leaders should check how staff phones are managed, which app installs are allowed, and whether sideloading is blocked. These findings come from a security vendor.
Stealing data is easy. Reading it is slow.
A phone full of stolen text messages is mostly noise. Delivery notices, promotions and chat sit alongside the few messages that matter. Sorting them has traditionally taken human effort.
Zimperium's zLabs research team says the operators of an Android trojan called ArcticRAT added AI to this step. Zimperium describes the aim as avoiding the bottleneck of sifting through stolen data by hand.
Here is the interpretation. If the feature works as intended, a model that reads and profiles stolen data could lower the effort needed per infected phone. That is our reading, not a finding. Zimperium reports observed code, prompts and one API call. It does not report how well the extraction performs or how many victims it was used on.
What Zimperium found
The malware started as spyware aimed at people using 11 particular cryptocurrency apps. Zimperium says it is now a remote access trojan, meaning it lets an attacker operate the phone from afar.
Zimperium describes a single malware family. Its tally covers 78 malware samples, 42 droppers (the small first-stage apps), 36 payloads and 129 commands in the control code. It also lists 21 server addresses. Its network section counts 17, and the report does not explain the gap. The report gives no victim count.
The researchers say AI features first appeared in samples analysed around mid-July 2026. They tracked versions from v6.3 to v6.5.2 and read that as continuing development. Zimperium sells mobile defence products, so read its advice with that in mind.
How the AI step works
When an operator sends a command named <xAI_API>, the control server sends an API key to the infected phone. The phone then queries an AI service using instructions built into the malware. Zimperium saw it call xAI's API with a model named grok-4.20-0309-non-reasoning.
There are two prompts. The first reviews installed apps and picks out banking, cryptocurrency and trading software. The second reads stolen text messages. It drops promotions and keeps one-time codes, balance changes and transfer notices.
That second prompt also asks the model to project the victim's financial standing from patterns in the text. So the model is asked to profile as well as filter. The answer comes back as structured JSON, a tidy data format. The phone stores it in a local folder, and a further command, <Get_AI_ANA_Data>, sends it to the attackers.
Here is a defensive point. The phone itself talks to the AI service, so the stolen text leaves the device on a connection to an AI endpoint. Traffic to AI services from an app with no reason to use them is a signal a defender can look for. Zimperium says its app vetting flags embedded AI API calls and its web filtering blocks connections to attacker servers. The report does not say whether xAI has acted on the abuse.
How it gets in and takes over
Zimperium says victims arrive through malvertising, text-message phishing or third-party forums. The main landing page imitated Google Play. The apps posed as Amazon, TikTok, file managers and crypto apps. Researchers also saw payloads delivered from Amazon Web Services storage buckets.
The first-stage app asks for VPN permission and uses it to cut the phone's network traffic. Zimperium says this blinds Google Play Protect's telemetry while the real payload installs. A fake installation screen is shown to deceive the user while permissions are obtained.
Once the user grants Accessibility Services, the malware can read the screen and act on it. That Android feature exists to help users who cannot easily see or touch the display. The malware also streams the screen and logs keystrokes. A black overlay with brightness at zero makes the phone look locked or off while the attacker works in a banking app.
Recent versions also abuse Wireless Debugging, a developer feature added in Android 11. The malware runs a Wireless ADB pairing routine, using a 6-digit pairing code the attacker types into the control panel. So this step involves a human operator. Through the resulting shell, Zimperium lists commands that check a stolen PIN against the phone, strip the lock screen or set a new code. That can lock the owner out.
What this means for an organisation
This report describes consumer fraud. It still matters to employers, because staff carry banking apps, work email and authentication codes on one phone. A trojan that reads one-time codes does not distinguish personal ones from work ones.
This is one malware family, and the report gives no victim count, so it is not evidence of a wider trend. It does show a design choice. The attackers added an AI model to the least glamorous step of the job.
Questions to put to your team
Ask whether work phones are managed and whether the company can see which apps are installed. Ask whether installing apps from outside Google Play is blocked. Zimperium's chief scientist told Dark Reading that organisations should enforce controls over app installation and permissions.
Ask how the company would learn that a phone was taken over while its screen looked off. Ask whether the banking and payment apps you rely on can detect screen sharing or overlays. Zimperium says its runtime protection can flag them. Ask whether anyone watches for unexpected connections from phones to AI services.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Zimperium.
