# ArcticRAT Android RAT Uses Fake VPN Tunnel to Evade Google Play Protect and xAI Grok for Financial Triage

> ArcticRAT is a modular Android remote access trojan that began as spyware aimed at users of 11 cryptocurrency apps and now provides full device takeover with LLM-assisted triage of stolen SMS and app data. Its dropper creates a null-routed VPN tunnel to blind Google Play Protect telemetry during staging, and newer builds (6.3 to 6.5.2) abuse Android Wireless Debugging for shell-level control.

- **Published:** 2026-11-14T00:57:03Z
- **Last reviewed:** 2026-11-14T00:57:03Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-6014
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-6014.png
- **ID:** TL-2026-6014
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 22 (3 shown free below)

## Description

ArcticRAT is an Android RAT catalogued by Zimperium zLabs (report by Rajat Goyal and Fernando Ortega, published 2026-11-12, covered by GBHackers on 2026-11-13). Researchers documented 78 unique samples (42 droppers, 36 payloads), 129 distinct C2 commands, two variants and builds 6.3 to 6.5.2. The report's summary cites 21 C2 IP addresses and its network section cites 17; the published c2.csv lists 36 rows that deduplicate to 21 addresses, two of them RFC1918 (10.x) values, so 19 are public. About two-thirds of C2 IPs are in Hong Kong and about 20% in Germany. The name derives from early package names such as net.iceflow.arcticlink and net.frostlink.iceforge. The family started as spyware targeting users of 11 cryptocurrency apps (not named in the sources) and evolved into a modular tool for full device takeover. AI features first appeared in samples from about mid-July 2026, which Zimperium treats as the campaign's pivot point.

Distribution and installation: the primary vector is a phishing landing page impersonating Google Play, reached via malvertising, smishing or third-party forums; some payloads are served directly from Amazon Web Services buckets (bucket names not published). Lures impersonate Amazon, TikTok, generic file managers and popular crypto apps, and the dropper shows a fake Amazon app interface in a WebView. The dropper requests VpnService privileges and establishes a tunnel (session name VlockPJO; addresses 10.0.0.2/24 and fd00:1:1:1::1/64 with routes 0.0.0.0/0 and ::/0) with no upstream connection, null-routing device traffic. According to Zimperium this blinds Google Play Protect telemetry while the payload is staged. The dropper decrypts the payload from its internal assets folder, installs it through the native package session installer, then closes the VPN.

Capabilities: after Accessibility access is granted the malware sends a DEVINFO JSON profile (battery, screen state, Wi-Fi status, wallpaper, geolocation, foreground activity), which also helps detect sandboxes. It streams the screen as JPEG frames (header, timestamp, JPEG size, width, height) via MediaProjection/VirtualDisplay, runs a Hidden VNC channel, streams microphone audio, exfiltrates contacts (CON_TE_CT), places calls/USSD (call_snd), sends SMS via SmsManager, and can draw a black overlay with brightness set to zero so the phone appears switched off. A fake ransomware screen with an endless progress bar is shown (Attack_run default template, Attack_costom custom note); no files are encrypted. The Phsing command presents fake PIN, pattern or password lock screens (view IDs txtLockTitlePattern, txtLockSubtitlePattern); the credential is logged to phish_logs.txt and verified with 'locksettings verify --old' in a shell. Keystrokes and touch data are written to date-stamped JSON under the config staging folders, and staging folders are securely wiped. Raw TCP channels: 9999 main C2 and DEVINFO, 8888 HVNC, 5058 accessibility remote control, 5000 microphone, 5055 screen casting.

Persistence and housekeeping: boot intents including OEM-specific ones (Huawei, Vivo, Oppo), BroadcastReceivers for boot, incoming SMS and SCREEN_OFF, and a foreground service with a transparent or invisible notification. apk_remove self-uninstalls the app and DELETE removes a named package.

Wireless Debugging abuse (newer builds, Android 11+): the malware uses mDNS/NsdManager to find the _adb-tls-pairing._tcp service and pairs with a 6-digit code supplied by the operator. With ADB shell it can enable or disable its own Accessibility service, query the lock type with 'dumpsys lock_settings', clear or reset the lock screen (locksettings clear / locksettings set-*; adb_clear_lock, adb_set_password/pin/pattern), blank the screen (adb_black_sc, adb_black_hiden) and lock the owner out.

LLM-assisted triage: the xAI_API command delivers an xAI API key to the device. Prompts filter installed apps for banking, crypto and trading software, sort SMS messages (discarding promotions, keeping one-time codes, balance changes and transfer notices), and ask the model to estimate the victim's financial standing as JSON. Calls to https://api.x.ai/v1/chat/completions using model grok-4.20-0309-non-reasoning were observed. Results are cached in /storage/emulated/0/config/AI_DATA/ and exfiltrated with the Get_AI_ANA_Data command.

Attribution: the sources give no attribution for ArcticRAT. Zimperium compares the approach to RatHat (Accessibility abuse, local ADB pairing, generative AI driving the UI), which it believes is linked to China-based actors because of Chinese-language LLM prompts; that link does not transfer to ArcticRAT. Zimperium published indicator lists (c2.csv, droppers.csv, payloads.csv, Commands.md) in its IOC GitHub repository; the hashes in them are MD5 and the IOC values below are taken from those files. A BeaconBeagle lookup of two C2 addresses returned HTTP 502 and no correlation could be confirmed.

## MITRE ATT&CK

- T1660 Phishing
- T1404 Exploitation for Privilege Escalation
- T1516 Input Injection
- T1417.002 GUI Input Capture
- T1417.001 Keylogging
- T1407 Download New Code at Runtime
- T1629 Impair Defenses
- T1629.002 Device Lockout
- T1655.001 Match Legitimate Name or Location
- T1628 Hide Artifacts
- T1630.001 Uninstall Malicious Application
- T1630.002 File Deletion
- T1398 Boot or Logon Initialization Scripts
- T1624.001 Broadcast Receivers
- T1541 Foreground Persistence
- T1426 System Information Discovery
- T1418 Software Discovery
- T1422 System Network Configuration Discovery
- T1636.004 SMS Messages
- T1636.003 Contact List
- T1636.002 Call Log
- T1513 Screen Capture
- T1429 Audio Capture
- T1512 Video Capture
- T1517 Access Notifications

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**ArcticRAT Fake Lock Screen Credential Capture and locksettings Tampering** (`TL-2026-6014-SPL-002`)

Detects ArcticRAT (TL-2026-6014) credential theft and device lockout: the Phsing fake PIN/pattern/password screens, credentials logged to phish_logs.txt and verified with 'locksettings verify --old', and lock reset via locksettings clear / set-* after Wireless Debugging pairing. Covers GUI Input Capture (T1417.002), Input Injection (T1516) and Device Lockout (T1629.002).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1417.002, T1516, T1629.002
- **Data sources:** android_logcat, mobile_threat_defense, mdm_audit
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=mobile sourcetype="android:logcat" earliest=-24h ("locksettings verify --old" OR "locksettings clear" OR "locksettings set-pin" OR "locksettings set-password" OR "locksettings set-pattern" OR "txtLockTitlePattern" OR "txtLockSubtitlePattern" OR "phish_logs.txt")
| eval behavior=case(like(_raw,"%locksettings verify --old%"),"credential_verify", like(_raw,"%locksettings clear%") OR like(_raw,"%locksettings set-%"),"lock_tamper", like(_raw,"%txtLock%"),"fake_lock_ui", like(_raw,"%phish_logs.txt%"),"credential_log", true(),"other")
| stats count min(_time) as firstTime max(_time) as lastTime values(behavior) as behaviors dc(behavior) as behavior_count by host
| where behavior_count>=2 OR isnotnull(mvfind(behaviors,"credential_verify|lock_tamper"))
| convert ctime(firstTime) ctime(lastTime)
| table firstTime lastTime host behaviors behavior_count count
```

### Microsoft KQL

```kql
AndroidLogcat_CL
| where TimeGenerated > ago(24h)
| where RawData has_any ("locksettings verify --old", "locksettings clear", "locksettings set-pin", "locksettings set-password", "locksettings set-pattern", "txtLockTitlePattern", "txtLockSubtitlePattern", "phish_logs.txt")
| extend Behavior = case(
    RawData has "locksettings verify --old", "credential_verify",
    RawData has "locksettings clear" or RawData has "locksettings set-", "lock_tamper",
    RawData has "txtLock", "fake_lock_ui",
    RawData has "phish_logs.txt", "credential_log",
    "other")
| summarize Events = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Behaviors = make_set(Behavior) by Computer
| where array_length(Behaviors) >= 2 or Behaviors has_any ("credential_verify", "lock_tamper")
| project FirstSeen, LastSeen, Computer, Behaviors, Events
```

### Sigma

```yaml
title: ArcticRAT Fake Lock Screen Credential Capture and locksettings Tampering
id: b5d1f7a2-6e39-4c84-9a0d-7e2b8c3f1a06
status: experimental
description: Detects the ArcticRAT Phsing command artefacts: fake PIN/pattern/password views (txtLockTitlePattern, txtLockSubtitlePattern), captured credentials in phish_logs.txt, validation via locksettings verify --old, and lock-screen reset or lockout via locksettings clear / set-*.
references:
    - https://zimperium.com/blog/arcticrat-ai-powered-android-rat
    - https://github.com/Zimperium/IOC/tree/master/2026-11-ArticRAT
    - https://gbhackers.com/arcticrat-malware-attack/
author: Threadlinqs Team
date: 2026-11-14
tags:
    - attack.credential_access
    - attack.t1417.002
    - attack.t1516
    - attack.defense_evasion
    - attack.t1629.002
logsource:
    product: android
    service: logcat
detection:
    selection:
        Message|contains:
            - 'locksettings verify --old'
            - 'locksettings clear'
            - 'locksettings set-pin'
            - 'locksettings set-password'
            - 'locksettings set-pattern'
            - 'txtLockTitlePattern'
            - 'txtLockSubtitlePattern'
            - 'phish_logs.txt'
    condition: selection
falsepositives:
    - Authorised device-management or forensic tooling running locksettings over ADB
    - Enterprise lock-screen reset by MDM on lost devices
level: high
```

**Known false positives:**

- Authorised MDM or forensic tooling that runs locksettings through ADB
- IT-driven remote lock-screen reset of lost or locked-out devices

**Tuning notes:** Logcat visibility into adb shell commands depends on the forwarder (MTD, MDM audit, EDR shell telemetry); adapt index, sourcetype and column names (index=mobile, android:logcat, AndroidLogcat_CL, RawData, Computer are conventions). Suppress known MDM service accounts and enrolled forensic workstations. Any locksettings verify --old from a non-shell app context is high fidelity.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- ArcticRAT Dropper Null-Routed VpnService Tunnel (Play Protect Blinding) (locked: unlock with TL Creds)
- ArcticRAT Wireless Debugging Self-Pairing and ADB Shell Abuse (locked: unlock with TL Creds)
- ArcticRAT Multi-Channel Raw TCP Beaconing (9999/8888/5058/5000/5055) (locked: unlock with TL Creds)
- ArcticRAT Dropper or Payload Package Name / MD5 Present on Device (locked: unlock with TL Creds)
- ArcticRAT On-Device Staging Folders and Housekeeping Commands (locked: unlock with TL Creds)
- ArcticRAT xAI Grok API Call from Android Client (LLM Financial Triage) (locked: unlock with TL Creds)
- ArcticRAT Off-Store APK Download by Android Client (T1660 Fake Google Play Lure) (locked: unlock with TL Creds)
- ArcticRAT Known C2 Infrastructure Connection (Zimperium c2.csv IPs) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 22)

Defanged, TLP:CLEAR.

- IP address: `167.148.195[.]29`
- URL: `hxxps://api[.]x[.]ai/v1/chat/completions`
- File hash: `09b25e0cf98f0808debb83ed922d5361`

Full set of 22 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [New ArcticRAT Malware Uses Fake VPN Connections to Evade Google Play Protect During Installation (GBHackers)](https://gbhackers.com/arcticrat-malware-attack/)
- [ArcticRAT: AI-Powered Android RAT (Zimperium zLabs)](https://zimperium.com/blog/arcticrat-ai-powered-android-rat)
- [Zimperium IOC repository: 2026-11 ArcticRAT (c2.csv, droppers.csv, payloads.csv, Commands.md)](https://github.com/Zimperium/IOC/tree/master/2026-11-ArticRAT)
- [AI-Powered RatHat Android Trojan Steals Bank Credentials (GBHackers)](https://gbhackers.com/ai-powered-rathat-android-trojan-steals-bank-credentials/)
- [New RatHat Android malware uses AI to automate device control (BleepingComputer)](https://bleepingcomputer.com/news/security/new-rathat-android-malware-uses-ai-to-automate-device-control)
- [MITRE ATT&CK Mobile: Phishing (T1660)](https://attack.mitre.org/techniques/T1660/)
- [MITRE ATT&CK Mobile: Input Injection (T1516)](https://attack.mitre.org/techniques/T1516/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-6014