[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f2MLYXU0Ak4zrKZxojv1-lTKdWPV-MCbMO5Ljmo5184o":3},{"article":4,"iocs":36,"watch_terms":52,"solutions":53,"lesson":132},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"a898d5a0-10a2-4fec-bec7-5ec8da2b890f","ArcticRAT Android Malware Uses Hidden VNC to Control Smartphones While Showing Victims a Black Screen","arcticrat-android-malware-uses-hidden-vnc-to-control-smartphones-while-showing-v-58995f","A new Android remote access trojan called ArcticRAT can take full control of a phone while the owner sees only a black screen. The device looks locked or switched off, but an attacker is opening banking apps, approving permissions and stealing data in the background. The malware began as a small spyware tool aimed at […] The post ArcticRAT Android Malware Uses Hidden VNC to Control Smartphones While Showing Victims a Black Screen appeared first on Cyber Security News.","ArcticRAT is a newly identified Android remote access trojan that evolved from cryptocurrency-targeting spyware into a full RAT with 129 control commands. The malware uses hidden VNC over port 8888 and displays a black screen overlay to conceal attacker activity while they access banking apps, approve permissions, and steal data. Recent variants incorporate AI APIs to analyze stolen messages, identify installed banking\u002Fcrypto apps, and estimate victim wealth.","ArcticRAT Android malware uses hidden VNC to remotely control phones while displaying a black screen to victims.","https:\u002F\u002Fcybersecuritynews.com\u002Farcticrat-android-malware\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FArcticRAT-Android-Malware-Uses-Hidden-VNC-to-Control-Smartphones-While-Showing-Victims-a-Black-Screen.webp","2026-11-13T07:51:50+00:00","2026-11-13T08:00:28.2642+00:00",9,[17,20,23],{"name":18,"type":19},"Zimperium","vendor",{"name":21,"type":22},"VNC","technology",{"name":24,"type":22},"Android Accessibility Service","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":25,"icon":27,"name":28,"slug":29},null,"Malware","malware",[31],{"category":32},{"id":33,"icon":27,"name":34,"slug":35},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[37,40,43,46,50],{"type":29,"value":38,"context":39},"ArcticRAT","Android remote access trojan with hidden VNC capabilities and 129 control commands",{"type":29,"value":41,"context":42},"StreamRAT","Android banking trojan using similar black screen overlay tactics",{"type":29,"value":44,"context":45},"RATHat","Android malware abusing Accessibility access, similar staging techniques",{"type":47,"value":48,"context":49},"domain","net.iceflow.arcticlink","Early ArcticRAT package name identifier",{"type":47,"value":51,"context":49},"net.frostlink.iceforge",[18],{"controls":54,"vendors":131},[55,84,105],{"slug":56,"name":57,"problem":58,"products":59},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[60,68,76],{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"slug":85,"name":86,"problem":87,"products":88},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[89,97],{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":106,"name":107,"problem":108,"products":109},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[110,118,126],{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":127,"product_name":128,"url":129,"description":130},"managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",[],{"slug":133,"title":134,"body":135,"framework_refs":136,"framework_notes":142},"arcticrat-uses-hidden-vnc-and-ai-to-silently-loot-banking-apps-on-android","ArcticRAT Uses Hidden VNC and AI to Silently Loot Banking Apps on Android","ArcticRAT is a sophisticated Android RAT that installs through sideloaded or trojanized apps, then operates a hidden VNC session on port 8888 while displaying a black screen overlay to mask attacker activity from the device owner. Attackers exploit the covert channel to open banking and crypto apps, approve permissions, and exfiltrate sensitive data entirely without the victim's awareness. Newer variants leverage AI APIs to triage stolen messages and estimate victim wealth, enabling targeted follow-on attacks. This matters because the attack chain succeeds largely due to victims sideloading untrusted apps and granting excessive permissions, making user behaviour the primary attack surface. Organisations with mobile device fleets and individuals who handle financial transactions on Android are especially at risk.",[137,138,139,140,141],"MITRE ATT&CK T1418: Software Discovery","MITRE ATT&CK T1664: Exploitation for Initial Access","CIS Control 2: Inventory and Control of Software Assets (v8)","NIS2 Article 21(2)(g)","NIST SP 800-53 SC-7: Boundary Protection",{"NIS2 Article 21(2)(g)":143,"MITRE ATT&CK T1418: Software Discovery":144,"NIST SP 800-53 SC-7: Boundary Protection":145,"MITRE ATT&CK T1664: Exploitation for Initial Access":146,"CIS Control 2: Inventory and Control of Software Assets (v8)":147},"Basic cyber hygiene and user training on the dangers of sideloading apps and granting excessive permissions would have reduced the likelihood of ArcticRAT gaining a foothold.","ArcticRAT enumerates installed banking and crypto apps on the victim device to identify high-value targets, which is exactly the mobile software discovery technique this entry covers.","Enforcing boundary controls that block unexpected outbound connections on ports like 8888 would have disrupted ArcticRAT's hidden VNC command-and-control channel.","The malware relies on users sideloading trojanized APKs outside official app stores, exploiting the installation vector to gain a foothold on the device.","Maintaining an allowlist of authorised mobile applications would have prevented the unauthorised ArcticRAT APK from executing on managed devices."]