ArcticRAT Trojans Use xAI's Grok to Extract OTPs From Stolen SMS

Zimperium's research unit zLabs disclosed on November 12, 2026 an Android remote-access trojan, ArcticRAT, that calls xAI's API to use the Grok model for sorting stolen text messages. The trojan began as spyware aimed at 11 cryptocurrency applications and has since evolved into a modular RAT that remains under active development, according to the firm's findings.

The AI component arrived in mid-July 2026 and represents one of the most significant updates in the malware's development so far. Newer versions feed Grok stolen SMS messages and lists of installed apps; the model extracts valuable material such as one-time passcodes and transaction alerts, and returns results in structured JSON format. Zimperium logged 78 unique samples in total — 42 droppers and 36 payloads — alongside 21 command-and-control IP addresses, most of them hosted in Hong Kong and Germany.

The numbers deserve a caveat. Because Zimperium describes the campaign as ongoing, the 78 samples and 21 C2 addresses form a snapshot rather than a final count. Every figure here is a floor, not a ceiling.

How does the malware take over a device?

Zimperium documented several mechanisms working in concert. Hidden virtual network computing lets an attacker control the screen while the owner sees nothing. Deceptive overlays and fake lock screens reinforce the illusion. The trojan also abuses Android's Accessibility Services — features designed to help users with disabilities — which, once misused, grant an app broad power to read screens and tap buttons autonomously.

Distribution follows familiar routes rather than novel technique:

• Fake Google Play listings imitating legitimate applications
• Malvertising that redirects victims to infected downloads
• SMS phishing lures prompting installation

None of these channels is new. What changed is the automation layered on top of them.

What does Grok actually do for the attackers?

The task is unglamorous but efficient: instead of a human operator reading through a victim's message history, the model triages it. It identifies one-time passcodes and financial details from stolen SMS traffic and returns structured output the malware can act on. In effect, the attacker outsources the reading.

This raises an uncomfortable operational question for xAI and other model providers. ArcticRAT reaches Grok through xAI's public API — the same front door legitimate developers use. Zimperium's findings show a general-purpose model can be slotted into a criminal workflow without the model itself behaving in any unusual way. The abuse is architectural, not detectable at the inference level, at least based on what the research discloses.

Zimperium has not said whether xAI revoked any API keys or whether the company was informed before publication. That gap leaves open the question of remediation, and the absence of a stated response is itself notable.

Is this the first AI-assisted attack on 2FA?

No. In September 2026, researchers disclosed RatHat, which also used AI to make attacks against two-factor authentication more efficient. ArcticRAT is the second documented case in roughly two months, which suggests a pattern rather than an anomaly. Criminal tooling tends to commoditize quickly once a technique proves out; however, no data in the disclosure quantifies how many devices were actually compromised.

What does this mean for crypto users and platforms?

ArcticRAT's original targets were cryptocurrency applications, and its upgraded capabilities aim squarely at the security codes protecting those accounts. For platforms, the implication is that SMS-based one-time passcodes are now the object of machine-assisted extraction, not merely interception. For users, accessibility permissions and sideloaded or imposter app listings remain the practical attack surface, though Zimperium's disclosure does not specify victim counts or geographic concentration.

The disclosure states development is continuing. Expect further variants with refined AI integration until either xAI tightens API abuse detection or the C2 infrastructure is dismantled — and neither outcome has a stated deadline.