Android Trojan ArcticRAT Uses Grok to Mine Stolen Texts for OTPs

Security firm Zimperium disclosed Thursday, Nov. 12, that the Android remote-access trojan ArcticRAT now calls xAI's API to run Grok over text messages and installed-app lists on infected phones, extending malware that began by targeting 11 cryptocurrency applications into a tool that hunts for login codes and transaction alerts.

ArcticRAT is an Android RAT, malware that hands an operator remote control of a device. It started as spyware aimed at 11 crypto apps before growing into a modular tool. Zimperium has catalogued 78 samples: 42 droppers and 36 payloads. Versions carrying the AI integration surfaced around mid-July 2026, and development remains active.

How does the Grok integration work?

On infected devices, the malware's prompts instruct Grok to identify banking, cryptocurrency and trading apps from the installed-app list. Other prompts direct the model to inspect messages for one-time passcodes (OTPs) and transaction alerts. Grok's responses come back in a structured JSON format, which lets the trojan parse output programmatically rather than relying on keyword matching.

Distribution runs through malvertising and SMS phishing that steer users to malicious downloads, with fake Google Play listings imitating legitimate apps as the main delivery channel.

After installation, ArcticRAT abuses Android Accessibility Services — the framework meant to help users interact with their devices — to read screens and activate controls. It also deploys Hidden VNC (HVNC), which lets an attacker control the screen while hiding the activity from the phone's owner. Deceptive overlays and fake lock screens add further cover on the device.

Zimperium tied ArcticRAT samples to 21 command-and-control IP addresses, most of them hosted in Hong Kong and Germany.

Why does this matter for crypto users?

The prompts reach beyond cryptocurrency apps into banking and trading services. For crypto holders, the combination is the point: the infection identifies which financial apps sit on a phone, then searches messages for information tied to those specific services.

OTPs are commonly required at login, and transaction alerts expose account activity. Together, those two data streams let the operator locate relevant services on a device and harvest the message content connected to them — the raw material for account takeover, from exchange logins to withdrawal confirmations.

The operational consequence for defenders is that AI integration lowers the skill floor. Parsing unstructured SMS content for context — which app sent a code, what an alert means — used to require custom logic. An LLM API with JSON output handles it generically, and any provider's endpoint could be swapped in.

For exchanges and banks, the pattern also weakens SMS-based second factors. Where a phishing page captures a password and the trojan harvests the OTP in real time, SMS authentication offers little residual protection — an argument security teams have made for years that tooling like this makes concrete.

Zimperium's findings cover a malware family still in active development, with the AI-enabled lineage roughly four months old as of the disclosure. Expect copycat integrations to spread as long as model APIs remain cheap, unauthenticated-by-device and structurally indifferent to whether a prompt originates from malware.