Android malware ArcticRAT uses xAI's Grok to mine stolen texts for one-time codes

Mobile security firm Zimperium says its zLabs team found 78 samples of ArcticRAT, an Android remote-access trojan that sends stolen SMS messages to xAI's Grok API to pick out one-time passcodes, balance changes and transfer alerts and estimate a victim's finances. A second built-in prompt asks the model to flag banking, crypto and trading apps on the phone. The malware, which Zimperium says added the AI feature in mid-July 2026, spreads through fake Google Play pages, malicious ads and SMS phishing, and uses hidden remote control behind a black-screen overlay to take over devices.