Zimperium uncovers ArcticRAT malware using xAI’s Grok to mine stolen SMS codes

Zimperium researchers have identified ArcticRAT, a remote access trojan that calls xAI’s Grok chatbot to extract one-time passcodes from stolen SMS messages, marking an early case of generative AI embedded directly in malware command-and-control logic. The trojan intercepts incoming texts on infected devices and forwards them to Grok, which parses the content and returns the relevant verification code, letting attackers bypass SMS-based two-factor authentication without building custom parsing rules. The finding matters because SMS OTP remains a widespread second factor across crypto exchanges, wallets and fintech apps, so AI-assisted code extraction could make SIM-swap and SMS-interception attacks cheaper and more reliable at scale. Watch for other malware families adopting LLM calls for data triage, and for pressure on services to move beyond SMS toward phishing-resistant authentication such as passkeys and hardware security keys.