techjacksolutions.com • 2h
ArcticRAT: Zimperium Uncovers AI-Powered Android RAT Leveraging Grok API for Financial Theft
Zimperium zLabs has identified ArcticRAT, an advanced Android Remote Access Trojan (RAT) that integrates Grok/XAI Large Language Model (LLM) APIs to automate financial intelligence gathering. The malware employs social engineering lures—impersonating services like Amazon and TikTok—to deploy 78 unique samples and 42 droppers. Technically, ArcticRAT utilizes Hidden VNC (HVNC) and a black-screen module for complete device takeover, while the integrated LLM API parses exfiltrated SMS and application data to profile victims' financial status. This automation enables high-efficiency theft of banking credentials, PINs, and security codes via raw TCP command-and-control infrastructure.