Zimperium details ArcticRAT, Android malware that blanks the screen while attackers raid banking apps

Zimperium unmasks ArcticRAT

Security researchers at Zimperium's zLabs team have documented a new Android threat they call ArcticRAT: a remote access trojan that can make a victim's screen look switched off while an operator quietly opens banking apps, approves system prompts and reads messages behind the darkened glass. The name comes from the package names of the earliest samples, net.iceflow.arcticlink and net.frostlink.iceforge, and the family is in active development, with analysed versions running from 6.3 to 6.5.2 and newer builds already seen in the lab. The findings are summarised in a write-up on dev.to.

Zimperium's tracking collected 78 unique samples, 42 first-stage installers and 36 final payloads, supported by 21 command-and-control addresses. These are laboratory figures; the company has not published a count of affected people.

From crypto spyware to full trojan

According to Zimperium, the family began as narrow spyware aimed at users of 11 cryptocurrency apps. It has since become a complete remote access trojan whose control code implements 129 distinct commands covering surveillance, credential theft and hands-on operation of the device. About two-thirds of the command-and-control addresses analysed point to Hong Kong and roughly one-fifth to Germany.

A fake storefront and two permissions

Distribution starts away from the official store. Zimperium documented carefully crafted imitations of Google Play, spread through malicious advertising, deceptive text messages and third-party forums, with some downloads hosted on Amazon Web Services S3 buckets. The disguise changes with the bait: Amazon, TikTok, a file manager or a well-known cryptocurrency app.

The first program to land asks for VPN permission. With it, the malware sets up a tunnel that routes traffic nowhere and cuts the device's connectivity during installation, so Google Play Protect's telemetry stops reporting while a fake installer drawn in a web view decrypts the real payload, installs it through Android's session installer and then drops the VPN.

The installed payload next requests Accessibility access, which lets it read screen content, automate taps and gestures, log keystrokes and prepare for remote control.

Black screen outside, banking app inside

The remote session runs over a hidden-screen channel identified as HVNC on port 8888. Using Android's MediaProjection and VirtualDisplay APIs, the malware builds a virtual screen in memory and streams JPEG frames to the attacker's server; the main channel uses port 9999, the microphone port 5000 and screen streaming port 5055. While the operator works, the victim sees nothing: ArcticRAT draws an overlay that cannot be dismissed and sets brightness to zero whenever banking apps are opened or system permissions are auto-approved, so the phone looks locked or dead.

Grok sorts the stolen data

The detail Zimperium singles out is how the malware treats what it steals. A server command, named xAI_API in the code, supplies the phone with an API key and puts Grok to work organising the haul; the variant string grok-4.20-0309-non-reasoning was observed. One instruction reviews installed apps and flags banking, cryptocurrency and exchange services. Another processes text messages, discards advertising and isolates one-time codes, balance changes and transfer alerts. The output is a projected financial picture of each victim, stored as JSON files under /config/AI_DATA/. Zimperium first observed this integration in samples from mid-July 2026.

Fake lock screens and pretend encryption

Credential theft gets similar staging. A fake lock screen, adapted to the device's language, captures the pattern, PIN or password the owner types; the server can verify that key and, by abusing the wireless debugging feature introduced in Android 11, change the PIN and lock the owner out of the phone. A pseudo-ransomware module completes the set, showing an endless progress bar that simulates a file encryption that never happens.

Why it matters

The practical warning is narrow and usable: an app installed outside the official store that asks for VPN permission and then Accessibility access, in that order, is requesting exactly the two keys this operation runs on. The remote control is the flashy part, but the lasting damage may come from the automated triage of messages and balances, which turns opportunistic theft into an ordered list of victims ranked by how much money is available to take. Development continues beyond version 6.5.2, and for now the public record stops at 78 samples and 129 commands.