ArcticRAT Android RAT evolves with AI-assisted financial triage and fake VPN to evade Google Play Protect
The ArcticRAT Android remote access trojan (RAT) has evolved from spyware targeting cryptocurrency app users into a modular, AI-assisted tool capable of full device takeover. Recent versions (6.3 to 6.5.2) incorporate an innovative approach that uses a fake VPN connection to null-route device traffic, effectively blinding Google Play Protect telemetry during installation. It also sends stolen SMS and app data to a large language model for automated financial triage, analyzing sensitive data such as one-time codes and balance changes. Infection lures mimic trusted apps and services, and the malware abuses Accessibility permissions and Wireless Debugging to escalate privileges, capture credentials, and maintain persistence. The threat uses multiple TCP ports for its command-and-control channels, including hidden VNC and screen casting, employing overlays to conceal attacker activity. Defenders should be alert to unusual VPN permission prompts, unexpected Accessibility grants, and Wireless Debugging activation on Android devices.
Linha do tempo
-
ArcticRAT Android RAT evolves with AI-assisted financial triage and fake VPN to evade Google Play Protect
ler a análise desta fonte ocultar
The ArcticRAT Android remote access trojan (RAT) has evolved from spyware targeting cryptocurrency app users into a modular, AI-assisted tool capable of full device takeover. Recent versions (6.3 to 6.5.2) incorporate an innovative approach that uses a fake VPN connection to null-route device traffic, effectively blinding Google Play Protect telemetry during installation. It also sends stolen SMS and app data to a large language model for automated financial triage, analyzing sensitive data such as one-time codes and balance changes. Infection lures mimic trusted apps and services, and the malware abuses Accessibility permissions and Wireless Debugging to escalate privileges, capture credentials, and maintain persistence. The threat uses multiple TCP ports for its command-and-control channels, including hidden VNC and screen casting, employing overlays to conceal attacker activity. Defenders should be alert to unusual VPN permission prompts, unexpected Accessibility grants, and Wireless Debugging activation on Android devices.