ArcticRAT Android Malware Uses Hidden VNC to Control Smartphones While Showing Victims a Black Screen

A new Android remote access trojan called ArcticRAT can take full control of a phone while the owner sees only a black screen.

The device looks locked or switched off, but an attacker is opening banking apps, approving permissions and stealing data in the background.

The malware began as a small spyware tool aimed at users of 11 cryptocurrency apps. It has since grown into a full remote access trojan with 129 control commands, and its latest versions use hidden VNC (a remote screen-control method) and artificial intelligence to speed up theft.

Its name comes from early package names such as net.iceflow.arcticlink and net.frostlink.iceforge. Researchers at Zimperium’s zLabs team identified and tracked the malware.

They found 78 unique samples, 42 dropper samples, 36 payloads and 21 command-and-control (C2) IP addresses. Their work shows a campaign that keeps changing. Samples from version 6.3 to 6.5.2 point to steady, active development.

ArcticRAT Android Malware Uses Hidden VNC

The infection starts when a victim lands on a fake site through malicious ads, text messages or third-party forums. Most droppers used a page that copied Google Play.

Some payloads came straight from Amazon Web Services storage. The apps pretended to be Amazon, TikTok, file managers and crypto tools.

The dropper then does something clever. It asks for VPN permission and uses it to cut off the phone’s network traffic, which blinds Google Play Protect while the real payload is installed.

It shows a fake install screen, decrypts the hidden payload, installs it and shuts the VPN off. This staging trick echoes the Accessibility abuse seen in RATHat abused Gemini AI campaigns reported earlier.

Once the victim grants Accessibility access, the malware contacts its C2 server on port 9999 and sends a device profile covering battery level, screen state and Wi-Fi.

It also grabs the wallpaper, likely to check that it is running on a real phone and not a sandbox. The server then picks which tools to switch on.

Hidden VNC runs over port 8888 and builds a virtual display in memory. Screen frames are sent out as JPEG images, so the operator sees and controls the phone live.

The black screen is the key trick. While the attacker works in banking apps or approves permissions, ArcticRAT draws a black overlay that cannot be dismissed and drops brightness to zero.

Victims think the phone is locked. Similar tactics appear in the StreamRAT Android banking trojan, showing that criminals now favor this quiet style of control.

Fake Ransomware, AI Data Theft and Lock Screen Takeover

ArcticRAT also carries a fake ransomware screen. It shows a progress bar that loops forever and claims files are being encrypted, yet nothing is encrypted. The goal is to scare victims into paying.

The more worrying change is the use of AI. A command called xAI_API sends the phone an API key and prompts. One prompt scans installed apps for banking, crypto and trading tools.

Another reads stolen text messages, drops promotional noise and keeps one-time codes, balance changes and transfer notices. It even estimates how wealthy the victim is.

Zimperium saw the malware call the xAI service with the grok-4.20-0309-non-reasoning model and store the answers in /storage/emulated/0/config/AI_DATA/.

Hidden-screen tools like this resemble the Windows-side tricks in Shadow hVNC remote desktop control, now moved to phones.

ArcticRAT also steals the phone’s unlock code. A fake lock screen, started by the Phsing command, captures the PIN, pattern or password.

The malware then tests the stolen code with the shell command locksettings verify. Newer versions abuse Android’s Wireless Debugging, found in Android 11 and later, to get a privileged ADB shell.

With it, the malware can turn on its own Accessibility rights, remove the lock screen, or set a new PIN that locks the owner out. Keystrokes, taps and screenshots are saved in hidden folders under /storage/emulated/0/config/ before being sent out.

Earlier reports on a hidden VNC banking trojan showed how dangerous this approach is when paired with overlays. Users should install apps only from the official Play Store and avoid links in ads and text messages.

They should refuse unexpected requests for Accessibility, VPN or screen-sharing access. A phone that suddenly looks locked, goes dark or acts strangely should be disconnected and checked right away. Banks and companies should watch for screen sharing, overlay use and Accessibility abuse during sensitive sessions.

Indicators of comproise (IoCs):-

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context on the latest threats to stop incidents quickly -> Integrate Threat Intel from 16K SOCs