ArcticRAT Android malware uses hidden VNC to control phones, with victims seeing only a black screen

Article title: ArcticRAT Android malware uses hidden VNC to control phones, with victims seeing only a black screen

Body:

A new Android remote access trojan named ArcticRAT can take full control of a user's phone, while the device owner sees only a black screen interface. The device appears to be locked or powered off, but the attacker has already opened banking apps in the background, automatically approved various sensitive permission requests, and stolen data.

The malware initially was a small spy tool targeting only users of 11 cryptocurrency apps. It has now evolved into a fully featured remote access trojan supporting 129 control commands, and the latest version also uses hidden VNC (a remote screen control technology) and artificial intelligence to improve data theft efficiency.

The name ArcticRAT comes from the package names of early versions, net.iceflow.arcticlink and net.frostlink.iceforge. It was discovered and has been continuously tracked by researchers from Zimperium's zLabs team. The researchers found a total of 78 unique samples, 42 dropper samples, 36 malicious payloads, and 21 command-and-control (C2) server IP addresses. The related campaign has continued to iterate, and samples from versions 6.3 to 6.5.2 show that the malware is still under steady, active development.

Fake distribution channels trick users into installing, hidden VNC enables black-screen silent control

ArcticRAT's infection chain begins with malicious ads, SMS messages, or third-party forums directing traffic, after which victims who click are taken to impersonation websites. Most droppers are hosted on pages impersonating Google Play, and some payloads come directly from 亚马逊 cloud technology storage services, disguised as various apps such as 亚马逊 clients, TikTok, file managers, and cryptocurrency tools.

The dropper is cunningly designed. It first requests VPN permissions and uses them to cut off the phone's network traffic, preventing Google Play Protect from detecting the installation of the subsequent real payload. It then displays a fake installation progress interface, decrypts the hidden payload, completes installation, and then closes the VPN connection. This staged-loading technique is exactly the same as the approach used in the previously reported RATHat campaign abusing Gemini AI, which exploited accessibility services.

Once the victim grants the malware accessibility permissions, ArcticRAT connects to the C2 server on port 9999 and uploads device configuration data including battery level, screen status, and Wi-Fi information. It also captures the user's current wallpaper, most likely to verify that it is running on a real device rather than in a sandbox environment, after which the server selects and enables the corresponding attack module based on the device situation.

Phishing website impersonating Google Play (Source: Zimperium)

The hidden VNC module runs on port 8888, builds a virtual display in device memory, and sends screen images back in real time in JPEG format, allowing attackers to view and control the victim's phone synchronously.

Black-screen deception is ArcticRAT's core concealment method. When the attacker operates banking apps or approves permission requests, ArcticRAT draws a black overlay on top of the screen that cannot be closed, while also setting screen brightness to 0, making the victim believe the phone is in a locked state. Similar techniques have also appeared in the campaign of the Android banking trojan StreamRAT, indicating that this silent control method has become a mainstream choice for cybercriminals.

Built-in fake ransomware interface intimidates users, AI assists data theft and hijacks the lock screen

ArcticRAT also has a built-in fake ransomware interface that displays an infinitely looping encryption progress bar and falsely claims to be encrypting the user's files. In fact, it does not encrypt any files at all; its sole purpose is to intimidate victims into paying a ransom.

Even more noteworthy is that the malware has introduced AI capabilities. Its built-in xAI_API command can deliver API keys and prompts to the phone, and one of the prompts scans installed apps on the device to identify high-value target apps in banking, cryptocurrency, and trading categories.

Ransomware overlay screen presented by the malware (Source: Zimperium)

Another prompt is responsible for analyzing stolen SMS content, filtering out promotional spam, extracting sensitive content such as one-time verification codes, balance change notifications, and transfer notifications, and can even assess the victim's asset level.

Zimperium observed that the malware calls the grok-4.20-0309-non-reasoning model of the xAI service and stores the returned results under the path /storage/emulated/0/config/AI_DATA/. This type of hidden screen control technique was first seen in the Shadow hVNC remote desktop control tool on the Windows platform and has now been migrated to mobile attack scenarios.

ArcticRAT also steals the user's phone unlock password. It uses the Phsing command to launch a fake lock screen interface, records the PIN, unlock pattern, or password entered by the user, and then calls the shell command locksettings verify to verify whether the stolen password is correct. The new version also abuses the wireless debugging feature on Android 11 and above to obtain a high-privilege ADB shell, enable accessibility permissions on its own, remove the original lock screen, and set a new PIN to lock the device owner out of the system. The user's key inputs, touch operations, and screenshots are first stored in a hidden folder under the path /storage/emulated/0/config/ and then exfiltrated to the attacker's server.

Previous reports on banking trojans with hidden VNC functionality have already pointed out that this type of attack combining the technique with interface overlays is extremely high-risk. Ordinary users should install apps only from the official Play Store, avoid clicking unknown links in ads or SMS messages, and deny unexpected requests for accessibility, VPN, or screen-sharing permissions. If the phone suddenly shows a lock screen, black screen, or other abnormal behavior, users should immediately disconnect from the network and investigate. Banks and enterprises should monitor screen-sharing behavior, overlay window invocation, and abuse of accessibility permissions during sensitive business sessions.

Related indicators of compromise list

The following are the ArcticRAT-related indicators of compromise (IoCs) compiled by the researchers:

Note: The IP addresses and domain names mentioned in this article have been deactivated (for example, replaced with the _[.]_ format) to prevent accidental resolution or direct redirection. The original addresses should be restored for use only in controlled threat intelligence platforms such as MISP, VirusTotal, or an enterprise internal SIEM.

ArcticRAT Android Malware Uses Hidden VNC to Control Smartphones While Showing Victims a Black Screen