Mindloop Experience

ArcticRAT Explained: The Android Malware That Uses Grok to Read Your Texts

Zimperium found Android malware that feeds stolen texts to Grok to find login codes. Here is what it does and how to protect your phone.

Mindloop EditorialTech
7 min read
Graphic of a phone showing an SMS code next to a security shield with a tick, for an explainer on ArcticRAT Android malware

Security firm Zimperium has published research on ArcticRAT, an Android remote access trojan that can send a victim’s stolen text messages to xAI’s Grok model to pick out one-time login codes and money-related messages. This explainer covers what the malware does, how it reaches phones according to the researchers, why an AI model in the loop matters, and the specific settings you can check on your own Android phone today.

What happened

On 12 November 2026, Zimperium’s zLabs research team published a report titled “Uncovering ArcticRAT: The Evolution from Targeted Crypto-Stealer to AI-Powered Android RAT”. According to the report, the malware started as spyware aimed at users of 11 cryptocurrency apps and has grown into a full remote access trojan, a tool that lets an attacker control an infected phone from afar.

The researchers say they analysed 78 unique samples, made up of 42 droppers (the installer apps victims are tricked into downloading) and 36 payloads (the actual spyware), and counted 129 distinct commands the operators can send to an infected device. The samples span versions 6.3 to 6.5.2, and Zimperium’s 12 November report describes the code as still under active development.

What ArcticRAT does

Zimperium’s report describes a long list of capabilities. The most important for ordinary users are these:

  • Abuses Accessibility Services. Once a victim grants accessibility access, the malware can read what is on screen, tap and type on the user’s behalf, and grant itself further permissions.
  • Steals SMS, notifications, contacts and call logs, and can send text messages and control calls.
  • Hidden remote control. It uses a hidden VNC-style screen session so the operator can use the phone, while a “black screen” overlay with brightness set to zero makes the device look switched off.
  • Fake lock screen. One command shows a fake lock screen to capture the victim’s PIN, pattern or password.
  • Wireless debugging abuse. It can use Android’s Wireless debugging feature to get a more privileged shell, which the researchers say can be used to clear or change the screen lock and lock the owner out.
  • Fake ransomware screen. A never-ending progress bar pretends files are being encrypted, though Zimperium says no encryption happens.

Where Grok comes in

According to Zimperium, the AI features first appeared in samples from around mid-July 2026. The operators send a command that pushes an xAI API key to the infected phone. The phone then calls xAI’s chat completions service in the cloud, using a model the researchers identify as grok-4.20-0309-non-reasoning. The model itself runs in xAI’s cloud, not on the device; the malware sends the prompts and stolen data over the internet and gets answers back.

The report describes two jobs for the model:

  1. Sorting installed apps. The model looks at the list of apps on the phone and picks out banking, crypto and trading apps.
  2. Sorting text messages. The model throws away promotional texts and pulls out one-time codes, balance changes and transfer notices. It is also asked to estimate the victim’s overall financial standing. The results are saved on the device and later uploaded to the attackers.

How it spreads

Zimperium reports that victims are lured through malicious ads, scam text messages (smishing) and links on third-party forums. The main trap is a phishing website made to look like the Google Play Store. The fake apps have posed as Amazon, file managers, TikTok and crypto apps, and some payloads were hosted on Amazon Web Services storage.

One detail stands out. During installation, the dropper turns on a VPN connection that sends all traffic nowhere. Zimperium says this blinds Google Play Protect’s telemetry while the spyware is being installed, after which the VPN is switched off.

Why an AI model inside malware matters

Text-stealing Android malware is not new; the change is speed and scale. A criminal crew used to need people or hand-written filters to find the few texts that matter. Handing that job to a general-purpose model means the operators can quickly tell which victims have money worth stealing and which codes to use first. It also shows that an ordinary cloud AI service can be pulled into criminal tooling with nothing more than an API key.

What we know and what we don’t know yet

The Zimperium report documents the malware’s capabilities, its use of Grok through xAI’s API, the sample counts and the distribution methods described above.

What is not yet public, as of 14 November 2026:

  • How many people have been infected, and in which countries. The report gives the locations of some attacker servers but not of victims, and server location says little about where the attackers are.
  • Who is behind the campaign.
  • Any public response from xAI about the API keys or from Google about the fake Play pages. We found none in the coverage we checked.

How to protect your Android phone

These steps are based on Google’s official help pages. Menu names vary between phone makers (Samsung, Xiaomi, OnePlus and others) and Android versions, so use your Settings search bar if a path does not match exactly.

Step 1: Only install apps from the real Play Store

The single most useful defence against ArcticRAT is not falling for the fake Play page. Open the Google Play Store app itself rather than following links from ads, texts or forums. A “Play Store” page in your browser that offers a file download is a red flag.

Step 2: Keep Google Play Protect on

Open the Play Store app, tap your profile icon at the top right, then Play Protect > Settings, and make sure Scan apps with Play Protect is on. Google says it also scans apps from outside Play. Treat it as a baseline, since Zimperium reports this malware tries to block Play Protect during installation.

Step 3: Lock down “Install unknown apps”

Go to Settings > Apps > Special app access > Install unknown apps. Tap any app listed as allowed, especially browsers, messaging apps and file managers, and turn off Allow from this source unless you have a clear reason to keep it.

Step 4: Check which apps use Accessibility

Open Settings > Accessibility and look at the apps and services listed there. Anything you did not knowingly set up, such as a “file manager” or “video” app, should be turned off and the app uninstalled.

Step 5: Review SMS and other sensitive permissions

Go to Settings > Security & privacy > Privacy > Permission manager, choose a permission type such as SMS (if listed), and review which apps have it. You can also go to Settings > Apps, pick an app, tap Permissions, and choose Don’t allow for anything it doesn’t need.

Step 6: Make sure Wireless debugging is off

Most people never need it. If you have turned on Developer options, check Settings > System > Developer options and confirm Wireless debugging is off.

Step 7: Move away from SMS codes

Since the malware targets texts, use an authenticator app or passkeys wherever your bank, email and crypto services allow. Google Authenticator generates codes on your phone and works offline. For your Google Account, you can create a passkey at myaccount.google.com/signinoptions/passkeys, which signs you in with your screen lock instead of a code that can be intercepted or phished.

Be realistic about the limits. Malware with full accessibility and screen control can still read what appears on screen, and this malware can capture your lock-screen PIN. Authenticator apps and passkeys stop codes being stolen from your texts, but neither makes an infected phone safe. If you suspect infection, use a different, trusted device to change passwords and contact your bank. Our guide on what to do after a data breach notice walks through that clean-up.

Common questions

Is Grok itself dangerous to use? No. The report describes criminals calling xAI’s API with a key the attackers supply. Using the Grok app does not infect your phone.

Is ArcticRAT on the Google Play Store? Zimperium’s report describes a fake Play Store website, not listings in the real store.

Can iPhones get ArcticRAT? The report covers Android only.

How would I know if I’m infected? Warning signs include an unknown app with accessibility access, a screen that suddenly goes black and won’t respond, an unexpected request for your lock screen PIN, or a “ransom” screen. If you see these, disconnect from the internet, remove suspicious apps and get help from your phone maker or carrier.

Wrap-up

ArcticRAT is a familiar kind of Android banking trojan with a new trick: it hands stolen texts to an AI model to sort out what is worth stealing. The defences are the same habits that stop most Android malware: install apps only from the real Play Store, keep Play Protect on, refuse accessibility requests from apps that don’t need them, and move important accounts off SMS codes. For another recent threat, see our Chrome zero-day explainer.

Malware like this does less damage when there are fewer forgotten accounts to break into. Our guide to finding every account that uses your username walks through a cleanup. For the everyday side of xAI’s model, see how to add Grok to your video calls.

Sources

Written by Mindloop Editorial

The Mindloop Experience editorial team writes clear, carefully sourced explainers and how-tos on tech, science, money and culture, for anyone who likes to know how things actually work.

About Mindloop Experience

Responses

Write a response

More from Mindloop Experience

See all from Mindloop Experience

You can clap up to 50 times.