STAR Labs: Android banking malware is built to send victims' texts to Grok

The thief no longer needs to read the texts

Banking malware has a boring core. It copies text messages and sends them to an attacker. That has been the model for a decade. The hard part was always sorting the haul: which bank, which message is a balance, which is spam.

STAR Labs researchers say a new Android family skips that work. They named it Groklem. According to their code analysis, it hands the texts to a frontier AI model and lets the model do the sorting. The model is xAI's Grok. The team traced this through the code and did not run the sample.

This is the idea worth holding onto. Attackers used to need analysts or long lists of hand-written rules to make stolen data useful. Now they can rent that judgement by the call. The malware only has to carry the messages.

What STAR Labs found

The researchers unpacked six builds of the malware. They say the builds use two different packers, six different command servers and six different lures. All six report to the same Telegram chat. STAR Labs concludes this is one operator running a production line.

The command set is large. STAR Labs recovered about 170 command strings from one build. The channel is a raw TCP socket on port 9999, not web traffic. In the researchers' words, the commands go well beyond copying messages, which makes this a banking trojan with a wide toolkit.

How the Grok step works

When the operator sends a command, the malware reads the victim's texts. By default it pulls the last ten days. It sends them to Grok with a prompt that asks for a structured report. The report covers one-time codes, transactions, balance updates, card alerts and PIN resets.

The prompt also tells the model to state the latest balance and predict the current one. A second prompt asks Grok to sort the victim's installed apps into banking, crypto, payment and stock-trading. It tells the model not to rely on any predefined list.

That design has a practical effect. STAR Labs found no hardcoded bank list. Hardcoded signs point toward India and Bangladesh: an eChallan traffic-fine lure, a hook for the PhonePe app, and a bKash example in the prompt. The researchers stress these show the operator's apparent intent, not where victims are. Because Grok identifies the bank, the same build could read messages from any institution.

The catch: the key belongs to the operator

None of the six payloads contains an xAI key. The operator pushes one over the command channel at runtime. According to STAR Labs, that command also switches the feature on, and the key is overwritten after a single analysis.

STAR Labs is clear about its limits. It traced this path statically through the code. It did not run the sample. Every build it holds ships without a key and with the feature off, so it never saw a key cross the wire.

The researchers draw a sharp conclusion from the design. The credential authenticates the operator's own paid xAI account. If it is ever provisioned, it is a receipt with the operator's name on it. STAR Labs says xAI logs the key against the account that issues the calls.

That account is one of two places the campaign could resolve to a person. The other is the Telegram chat ID, hardcoded the same way in all six builds. The researchers cannot resolve either themselves. They say the provider or law enforcement could.

The same dependence is a weakness. STAR Labs says the feature stops working if xAI throttles or revokes the key.

What leaders should ask

Our view: this is a story about where defence leverage sits. When criminals rent intelligence, the provider becomes a place where abuse can be seen and stopped. That works only if providers watch for it. Ask your vendors how they would detect and act on this kind of misuse.

Closer to home, three questions are worth putting to your teams.

First, ask your bank and payment partners how much they still rely on SMS codes. Any message that lands on a phone can be copied by malware with text access. Second, ask your mobile team what stops staff from installing apps from outside the official store. The source excerpt does not say how Groklem is delivered. Apps from outside the official store are a common route for banking malware, so the control is worth checking. Third, ask whether employees' phones are covered by your incident response plan when a banking app is involved.

One caution on scale. STAR Labs describes six builds and one apparent operator. This is one family, not a measured trend. The lesson is narrower and still useful: the sorting of stolen data, once slow and manual, can now be bought by the call.

Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: STAR Labs.