November 7, 2026
- Groklem is an Android banking RAT that rents Grok: it steals SMS/OTPs and WebView credentials, then ships them over a raw-TCP "courier" C2 to xAI's API using a runtime-delivered key, using the model to triage which victims are financially worth pursuing. Full banker feature set underneath — overlay injection, keylogging, device lock and extortion (STAR Labs). · Threat Intelligence