ArcticRAT Android RAT Uses Fake VPN Tunnel to Evade Google Play Protect and xAI Grok for Financial Triage

Key facts

Detection coverage

As of 2026-11-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-6014 across Splunk SPL, Microsoft KQL and Sigma, covering 22 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: ArcticRAT Fake Lock Screen Credential Capture and locksettings Tampering

Detects ArcticRAT (TL-2026-6014) credential theft and device lockout: the Phsing fake PIN/pattern/password screens, credentials logged to phish_logs.txt and verified with 'locksettings verify --old', and lock reset via locksettings clear / set-* after Wireless Debugging pairing. Covers GUI Input Capture (T1417.002), Input Injection (T1516) and Device Lockout (T1629.002).

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1417.002, T1516, T1629.002
• Data sources: android_logcat, mobile_threat_defense, mdm_audit
• Severity: critical
• Confidence: high

Splunk SPL

index=mobile sourcetype="android:logcat" earliest=-24h ("locksettings verify --old" OR "locksettings clear" OR "locksettings set-pin" OR "locksettings set-password" OR "locksettings set-pattern" OR "txtLockTitlePattern" OR "txtLockSubtitlePattern" OR "phish_logs.txt")
| eval behavior=case(like(_raw,"%locksettings verify --old%"),"credential_verify", like(_raw,"%locksettings clear%") OR like(_raw,"%locksettings set-%"),"lock_tamper", like(_raw,"%txtLock%"),"fake_lock_ui", like(_raw,"%phish_logs.txt%"),"credential_log", true(),"other")
| stats count min(_time) as firstTime max(_time) as lastTime values(behavior) as behaviors dc(behavior) as behavior_count by host
| where behavior_count>=2 OR isnotnull(mvfind(behaviors,"credential_verify|lock_tamper"))
| convert ctime(firstTime) ctime(lastTime)
| table firstTime lastTime host behaviors behavior_count count

Microsoft KQL

AndroidLogcat_CL
| where TimeGenerated > ago(24h)
| where RawData has_any ("locksettings verify --old", "locksettings clear", "locksettings set-pin", "locksettings set-password", "locksettings set-pattern", "txtLockTitlePattern", "txtLockSubtitlePattern", "phish_logs.txt")
| extend Behavior = case(
    RawData has "locksettings verify --old", "credential_verify",
    RawData has "locksettings clear" or RawData has "locksettings set-", "lock_tamper",
    RawData has "txtLock", "fake_lock_ui",
    RawData has "phish_logs.txt", "credential_log",
    "other")
| summarize Events = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Behaviors = make_set(Behavior) by Computer
| where array_length(Behaviors) >= 2 or Behaviors has_any ("credential_verify", "lock_tamper")
| project FirstSeen, LastSeen, Computer, Behaviors, Events

Sigma

title: ArcticRAT Fake Lock Screen Credential Capture and locksettings Tampering
id: b5d1f7a2-6e39-4c84-9a0d-7e2b8c3f1a06
status: experimental
description: Detects the ArcticRAT Phsing command artefacts: fake PIN/pattern/password views (txtLockTitlePattern, txtLockSubtitlePattern), captured credentials in phish_logs.txt, validation via locksettings verify --old, and lock-screen reset or lockout via locksettings clear / set-*.
references:
    - https://zimperium.com/blog/arcticrat-ai-powered-android-rat
    - https://github.com/Zimperium/IOC/tree/master/2026-11-ArticRAT
    - https://gbhackers.com/arcticrat-malware-attack/
author: Threadlinqs Team
date: 2026-11-14
tags:
    - attack.credential_access
    - attack.t1417.002
    - attack.t1516
    - attack.defense_evasion
    - attack.t1629.002
logsource:
    product: android
    service: logcat
detection:
    selection:
        Message|contains:
            - 'locksettings verify --old'
            - 'locksettings clear'
            - 'locksettings set-pin'
            - 'locksettings set-password'
            - 'locksettings set-pattern'
            - 'txtLockTitlePattern'
            - 'txtLockSubtitlePattern'
            - 'phish_logs.txt'
    condition: selection
falsepositives:
    - Authorised device-management or forensic tooling running locksettings over ADB
    - Enterprise lock-screen reset by MDM on lost devices
level: high

Known false positives:

• Authorised MDM or forensic tooling that runs locksettings through ADB
• IT-driven remote lock-screen reset of lost or locked-out devices

Tuning notes: Logcat visibility into adb shell commands depends on the forwarder (MTD, MDM audit, EDR shell telemetry); adapt index, sourcetype and column names (index=mobile, android:logcat, AndroidLogcat_CL, RawData, Computer are conventions). Suppress known MDM service accounts and enrolled forensic workstations. Any locksettings verify --old from a non-shell app context is high fidelity.

• 🔒 ArcticRAT Dropper Null-Routed VpnService Tunnel (Play Protect Blinding) · unlock with TL Creds
• 🔒 ArcticRAT Wireless Debugging Self-Pairing and ADB Shell Abuse · unlock with TL Creds
• 🔒 ArcticRAT Multi-Channel Raw TCP Beaconing (9999/8888/5058/5000/5055) · unlock with TL Creds
• 🔒 ArcticRAT Dropper or Payload Package Name / MD5 Present on Device · unlock with TL Creds
• 🔒 ArcticRAT On-Device Staging Folders and Housekeeping Commands · unlock with TL Creds
• 🔒 ArcticRAT xAI Grok API Call from Android Client (LLM Financial Triage) · unlock with TL Creds
• 🔒 ArcticRAT Off-Store APK Download by Android Client (T1660 Fake Google Play Lure) · unlock with TL Creds
• 🔒 ArcticRAT Known C2 Infrastructure Connection (Zimperium c2.csv IPs) · unlock with TL Creds

Indicators of compromise

As of 2026-11-14, Threadlinqs Intelligence tracks 22 indicators of compromise for TL-2026-6014.

Sample indicators (3 of 22)

• IP address: 167.148.195[.]29
• URL: hxxps://api[.]x[.]ai/v1/chat/completions
• File hash: 09b25e0cf98f0808debb83ed922d5361

Defanged, TLP:CLEAR. Full set of 22 indicators: unlock with TL Creds.

Technical analysis

ArcticRAT is an Android RAT catalogued by Zimperium zLabs (report by Rajat Goyal and Fernando Ortega, published 2026-11-12, covered by GBHackers on 2026-11-13). Researchers documented 78 unique samples (42 droppers, 36 payloads), 129 distinct C2 commands, two variants and builds 6.3 to 6.5.2. The report's summary cites 21 C2 IP addresses and its network section cites 17; the published c2.csv lists 36 rows that deduplicate to 21 addresses, two of them RFC1918 (10.x) values, so 19 are public. About two-thirds of C2 IPs are in Hong Kong and about 20% in Germany. The name derives from early package names such as net.iceflow.arcticlink and net.frostlink.iceforge. The family started as spyware targeting users of 11 cryptocurrency apps (not named in the sources) and evolved into a modular tool for full device takeover. AI features first appeared in samples from about mid-July 2026, which Zimperium treats as the campaign's pivot point.

Distribution and installation: the primary vector is a phishing landing page impersonating Google Play, reached via malvertising, smishing or third-party forums; some payloads are served directly from Amazon Web Services buckets (bucket names not published). Lures impersonate Amazon, TikTok, generic file managers and popular crypto apps, and the dropper shows a fake Amazon app interface in a WebView. The dropper requests VpnService privileges and establishes a tunnel (session name VlockPJO; addresses 10.0.0.2/24 and fd00:1:1:1::1/64 with routes 0.0.0.0/0 and ::/0) with no upstream connection, null-routing device traffic. According to Zimperium this blinds Google Play Protect telemetry while the payload is staged. The dropper decrypts the payload from its internal assets folder, installs it through the native package session installer, then closes the VPN.

Capabilities: after Accessibility access is granted the malware sends a DEVINFO JSON profile (battery, screen state, Wi-Fi status, wallpaper, geolocation, foreground activity), which also helps detect sandboxes. It streams the screen as JPEG frames (header, timestamp, JPEG size, width, height) via MediaProjection/VirtualDisplay, runs a Hidden VNC channel, streams microphone audio, exfiltrates contacts (CON_TE_CT), places calls/USSD (call_snd), sends SMS via SmsManager, and can draw a black overlay with brightness set to zero so the phone appears switched off. A fake ransomware screen with an endless progress bar is shown (Attack_run default template, Attack_costom custom note); no files are encrypted. The Phsing command presents fake PIN, pattern or password lock screens (view IDs txtLockTitlePattern, txtLockSubtitlePattern); the credential is logged to phish_logs.txt and verified with 'locksettings verify --old' in a shell. Keystrokes and touch data are written to date-stamped JSON under the config staging folders, and staging folders are securely wiped. Raw TCP channels: 9999 main C2 and DEVINFO, 8888 HVNC, 5058 accessibility remote control, 5000 microphone, 5055 screen casting.

Persistence and housekeeping: boot intents including OEM-specific ones (Huawei, Vivo, Oppo), BroadcastReceivers for boot, incoming SMS and SCREEN_OFF, and a foreground service with a transparent or invisible notification. apk_remove self-uninstalls the app and DELETE removes a named package.

Wireless Debugging abuse (newer builds, Android 11+): the malware uses mDNS/NsdManager to find the _adb-tls-pairing._tcp service and pairs with a 6-digit code supplied by the operator. With ADB shell it can enable or disable its own Accessibility service, query the lock type with 'dumpsys lock_settings', clear or reset the lock screen (locksettings clear / locksettings set-*; adb_clear_lock, adb_set_password/pin/pattern), blank the screen (adb_black_sc, adb_black_hiden) and lock the owner out.

LLM-assisted triage: the xAI_API command delivers an xAI API key to the device. Prompts filter installed apps for banking, crypto and trading software, sort SMS messages (discarding promotions, keeping one-time codes, balance changes and transfer notices), and ask the model to estimate the victim's financial standing as JSON. Calls to https://api.x.ai/v1/chat/completions using model grok-4.20-0309-non-reasoning were observed. Results are cached in /storage/emulated/0/config/AI_DATA/ and exfiltrated with the Get_AI_ANA_Data command.

Attribution: the sources give no attribution for ArcticRAT. Zimperium compares the approach to RatHat (Accessibility abuse, local ADB pairing, generative AI driving the UI), which it believes is linked to China-based actors because of Chinese-language LLM prompts; that link does not transfer to ArcticRAT. Zimperium published indicator lists (c2.csv, droppers.csv, payloads.csv, Commands.md) in its IOC GitHub repository; the hashes in them are MD5 and the IOC values below are taken from those files. A BeaconBeagle lookup of two C2 addresses returned HTTP 502 and no correlation could be confirmed.

MITRE ATT&CK techniques by tactic:

Persistence

T1398 Boot or Logon Initialization Scripts; T1541 Foreground Persistence; T1624.001 Broadcast Receivers

Privilege Escalation

T1404 Exploitation for Privilege Escalation

Defense Evasion

T1407 Download New Code at Runtime; T1628 Hide Artifacts; T1629 Impair Defenses; T1629.002 Device Lockout; T1630.001 Uninstall Malicious Application; T1630.002 File Deletion; T1655.001 Match Legitimate Name or Location

Credential Access

T1417.001 Keylogging; T1417.002 GUI Input Capture

Discovery

T1418 Software Discovery; T1422 System Network Configuration Discovery; T1426 System Information Discovery

Collection

T1429 Audio Capture; T1512 Video Capture; T1513 Screen Capture; T1517 Access Notifications; T1636.002 Call Log; T1636.003 Contact List; T1636.004 SMS Messages

defense-evasion

T1516 Input Injection

Initial Access

T1660 Phishing

Remediation

Immediate actions

• Alert on unexpected VPN permission prompts during app installation
• Monitor Accessibility service grants to newly sideloaded apps
• Flag Wireless Debugging being enabled without user action
• Hunt for packages net.iceflow.arcticlink and net.frostlink.iceforge and the directory /storage/emulated/0/config/AI_DATA/
• Review egress for raw TCP to ports 9999, 8888, 5058, 5000 and 5055 from mobile devices
• Search mobile and network telemetry for the C2 IP addresses and MD5 hashes listed in the IOC set

Workarounds

• Disable Developer Options and Wireless Debugging on managed devices
• Reset credentials (lock-screen PIN, banking and crypto accounts) from a clean device if infection is suspected

Longer-term hardening

• Enforce mobile threat defense (MTD) on managed devices
• Block sideloading / installation from unknown sources
• Restrict or alert on api.x.ai traffic from mobile devices where not business-justified
• Train users on smishing and fake Google Play pages

Affected and fixed versions

• Google — Android
  Vulnerable versions: Android devices permitting sideloading; Wireless Debugging abuse requires Android 11+

Timeline

• 2026-07-15 AI (xAI Grok) features first appear in ArcticRAT samples from about mid-July 2026 (date approximated to mid-month); Zimperium calls this the campaign's pivot point. Earlier builds were spyware targeting 11 cryptocurrency apps.
• 2026-09-17 BleepingComputer reports the RatHat Android malware (Accessibility + Wireless Debugging + AI UI automation), later compared by Zimperium to ArcticRAT.
• 2026-09-19 GBHackers covers RatHat, noting China-linked attribution based on Chinese-language LLM prompts.
• 2026-09-21 BleepingComputer adds a Google statement on RatHat: no apps containing the malware found on Google Play and Play Protect protects against known versions.
• 2026-11-12 Zimperium zLabs publishes ArcticRAT analysis: 78 samples, 42 droppers, 36 payloads, 21 C2 IPs, 129 commands, versions 6.3 to 6.5.2, plus an IOC repository (c2.csv, droppers.csv, payloads.csv, Commands.md).
• 2026-11-13 GBHackers publishes coverage of ArcticRAT's fake-VPN Play Protect evasion and Grok-based financial triage.

Sources cited

• ArcticRAT: AI-Powered Android RAT (Zimperium zLabs) zimperium.com · Research · 2026-11-12
• MITRE ATT&CK Mobile: Phishing (T1660) MITRE · Research
• MITRE ATT&CK Mobile: Input Injection (T1516) MITRE · Research
• Zimperium IOC repository: 2026-11 ArcticRAT (c2.csv, droppers.csv, payloads.csv, Commands.md) GitHub · Code repository · 2026-11-12
• New ArcticRAT Malware Uses Fake VPN Connections to Evade Google Play Protect During Installation (GBHackers) gbhackers.com · News · 2026-11-13
• AI-Powered RatHat Android Trojan Steals Bank Credentials (GBHackers) gbhackers.com · News · 2026-09-19
• New RatHat Android malware uses AI to automate device control (BleepingComputer) BleepingComputer · News · 2026-09-17

More in malware

• ClickFix in the Wild: New RATs (CrashHandler, CrocoRat), Stripe-Based C2, and Signed Google Tool Abused to Weaken Microsoft Defender
• Predator, Pegasus and Graphite Mercenary Spyware: Government-Linked Abuse Against Journalists, Activists and Politicians in Europe with Little Accountability
• Hackers Hijack Microsoft SQL Servers Using T-SQL Commands to Install Gh0st RAT and Crypto Miners
• AccuraSoftHire Fake Interview Campaign: PolinRider Loader Delivered via Malicious Tailwind npm Look-alikes and Fake Camera Driver to Developer Machines
• Gootloader Malware Disrupted in International Operation (Operation Endgame) After Infecting 25,000+ Computers