A new version of the ArcticRAT Android remote access trojan uses a large language model to analyze stolen messages and help operators identify the most valuable victims, according to mobile security company Zimperium.
Instead of forcing criminals to manually review every intercepted SMS and app notification, the malware sends collected text to an LLM for classification. Zimperium said the system looks for one-time passcodes, account balances, transfer confirmations and other signals that a device may offer immediate financial value.
That automation can compress the time between infection and theft. A large botnet may collect more data than human operators can review, but AI-assisted triage lets the group prioritize devices with active banking sessions, cryptocurrency activity or recent authentication codes.
The malware’s capabilities extend well beyond message theft. Researchers observed controls for launching banking apps, recording audio, keylogging, displaying a black screen to hide activity and presenting a fake lock screen to capture credentials. It can also abuse wireless Android Debug Bridge connections, giving operators another route to device control.
Zimperium describes the LLM analysis as an attacker-controlled feature, not an autonomous compromise mechanism. ArcticRAT still depends on infection, permissions and command infrastructure, but AI reduces the labor needed to turn stolen data into operational decisions.
For enterprises, the risk is especially acute on unmanaged or lightly managed Android devices that receive business email, authentication codes and banking notifications. A compromised phone can undermine strong desktop controls by exposing the second factor used to approve access.
Defenders should restrict sideloading, monitor accessibility-service abuse, block unauthorized debugging and require phishing-resistant authentication that does not depend on SMS. Zimperium published technical details in its ArcticRAT analysis for teams building detections and mobile threat-hunting workflows.