Groklem Android trojan rents xAI Grok to steal SMS

Researchers have discovered an Android banking trojan dubbed Groklem that rents xAI's Grok frontier model at runtime to automatically analyze and extract financial data from stolen SMS messages. The malware operates keyless in its builds, requiring the attacker to supply an xAI API key over the command channel to arm the feature and process victim texts into structured financial dossiers. In addition to SMS exfiltration, the Trojan features credential harvesting through WebView script injection, local privilege escalation via ADB, and remote monitoring capabilities. Open article →