New SurxRAT Android Malware Uses AI To Automate Phishing and Steal Data

SURXRAT is an advanced Android Remote Access Trojan (RAT) that has recently been identified as part of a growing malware-as-a-service (MaaS) ecosystem.

Zimperium many typical Android malware, SURXRAT is sold through structured reseller and partner licensing tiers, enabling widespread distribution by affiliates while maintaining centralized control by the operator.

This distribution model underscores the increasing professionalization of the Android malware landscape, where threat actors aim to scale operations and generate substantial revenue.

How SURXRAT Operates and Its Features

SURXRAT, currently marketed under the SURXRAT V5 brand, provides a full-featured surveillance and device-control platform. It is capable of extensive data exfiltration, remote command execution, and even locking devices in a ransomware-style attack.

By abusing accessibility permissions, SURXRAT ensures persistent control over infected devices and communicates with a Firebase-based command-and-control (C2) infrastructure. This infrastructure is used for real-time management of the compromised devices.

The malware can collect a wide range of sensitive information, including SMS messages, contact lists, call logs, device details, and browsing activity, making it a potent tool for credential theft and financial fraud.

SURXRAT’s ability to hide its communication with Firebase further complicates detection, as it blends malicious data transfers with legitimate cloud traffic.

In addition to its data theft capabilities, SURXRAT integrates a ransomware-style screen locker that denies access to infected devices.

Attackers can demand ransom from victims, locking their screens and requiring a PIN to unlock the device. This hybrid approach combining surveillance, fraud, and extortion—reflects the flexibility and evolving tactics employed by cybercriminals.

AI-Driven Enhancements and Evasion Techniques

The most notable recent evolution of SURXRAT is the inclusion of artificial intelligence (AI) modules, specifically large language models (LLMs).

These modules are conditionally downloaded from external repositories like Hugging Face, indicating that the operator is experimenting with AI to enhance operational capabilities.

AI-driven functionality is triggered under specific circumstances, such as when certain gaming apps are active on the device. For instance, when the Free Fire MAX x JUJUTSU KAISEN app is detected, the malware will download a large AI model.

This LLM module can serve various purposes, including introducing device lag to disrupt gameplay (potentially supporting paid cheating services), masking background malicious activities by degrading device performance, or enabling more sophisticated evasion techniques.

Zimperium malware’s ability to steal sensitive data, manipulate devices, and demand ransom demonstrates its versatility and the growing sophistication of mobile threats.

The integration of AI modules further enhances its effectiveness, making it a potent tool for cybercriminals.

To protect against SURXRAT and similar threats, users should only install apps from trusted sources, be cautious about granting unnecessary permissions, and enable multi-factor authentication (MFA) for sensitive applications.

Security solutions such as mobile security apps and threat intelligence platforms can help detect and mitigate the impact of these evolving threats.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.

The post New SurxRAT Android Malware Uses AI To Automate Phishing and Steal Data appeared first on Cyber Security News.