In early 2026, researchers uncovered a widespread Android malware campaign that stands out for its scale, sophistication, and innovative abuse of trusted cloud services. This campaign, now known as Arsink RAT, represents one of the most pervasive Remote Access Trojan (RAT) operations targeting Android devices seen in recent months.

Cloud-Native Malware With Global Reach

At its core, Arsink is a cloud-native Android RAT designed to covertly harvest private information and grant full remote control over compromised devices. Unlike traditional Android malware that relies on attacker-controlled servers, Arsink leverages widely trusted cloud platforms such as Google Firebase, Google Drive via Google Apps Script, and Telegram to manage command-and-control (C2) communications and data exfiltration.

The zLabs analysis identified:

• 1,216 unique malicious APK hashes, pointing to large variant churn and frequent repackaging.
• 317 distinct Firebase Realtime Database endpoints serving as C2 infrastructure and data sinks.
• ≈45,000 unique victim IP addresses across roughly 143 countries, illustrating the truly global footprint of this operation.

Social-Engineered Distribution

Rather than exploiting a single infection vector, Arsink spreads through social engineering and deceptive distribution:

• Malicious APKs are shared via Telegram channels, Discord posts, and file-hosting sites such as MediaFire.
• Threat actors impersonate more than 50 well-known brands (including Google, WhatsApp, YouTube, Instagram, Facebook, and TikTok) to trick users into downloading what appear to be legitimate or “modded” apps.
• File names are crafted to resemble desirable or premium versions of popular applications, encouraging users to sideload them on Android devices.

Once installed, these apps usually display minimal user interface elements, request intrusive permissions immediately upon launch, and then operate silently in the background.

Multiple Operational Variants

Arsink’s modular design includes several distinct variants, each using different techniques for C2 and data exfiltration:

1. Firebase + Google Apps Script / Drive Variant
   • Small structured data and telemetry are written to Firebase Realtime Database.
   • Audio recordings are uploaded to Firebase Storage.
   • Larger files and media are staged using Google Apps Script before being transferred to Google Drive.
     This method maximizes the use of cloud infrastructure to evade traditional malware detection.
2. Telegram Exfiltration Variant
   • Instead of Firebase, this variant sends stolen data directly to a Telegram bot using the Telegram Bot API.
   • SMS messages, device identifiers, and other harvested data are transmitted as plaintext messages.
     This approach provides a low-latency exfiltration path with minimal infrastructure overhead.
3. Embedded-Payload Dropper Variant
   • Some Arsink builds include a second malicious payload embedded inside their assets.
   • The RAT extracts this archive, repackages it locally, and sideloads it as a secondary APK without needing network downloads.
     This tactic complicates detection and takedown because no additional network downloads are required.

Capabilities: Data Theft and Remote Control

Arsink combines extensive data harvesting with remote control features. The malware actively collects and exfiltrates:

• Device identifiers, such as public IP, device model, OS version, battery status, and reverse-geocoded location notes.
• Communication data, including SMS messages (even one-time passwords), call logs, and contact lists.
• Audio recordings, photos, and arbitrary files from external storage, often using cloud services to upload them.
• Remote control actions, like toggling the flashlight, initiating calls, modifying wallpapers, displaying texts, listing, uploading, and deleting files, or even wiping external storage on command.

To sustain persistence and stealth, Arsink hides its launcher icon, runs lingering foreground services, and continuously polls for C2 commands via Firebase listeners or Telegram API.

Infrastructure Disruption and Defense

In response to this discovery, zLabs collaborated with Google to identify and dismantle many of the malicious Firebase endpoints and Google Apps Script instances used by the attackers. Google also disabled associated malicious accounts. Importantly, Google confirmed that known Arsink RAT variants have never appeared on Google Play, and devices are defended by Google Play Protect, which can warn users or block known malicious apps sourced from outside the official store.

Nevertheless, takedowns alone are insufficient due to Arsink’s rapid variant creation and flexible use of third-party cloud services. This highlights the need for on-device protection that can detect malicious behavior dynamically rather than relying solely on static indicators or network blocklists.

Conclusion: A Persistent and Evolving Threat

The Arsink campaign demonstrates how modern Android malware can evolve beyond classic C2 infrastructure, leveraging trusted cloud ecosystems to mask malicious activity while scaling worldwide. By exploiting user trust in popular brands and cloud services, operators behind Arsink have created a highly effective surveillance and control platform that remains challenging to contain.

For individuals and organizations alike, this threat underscores the necessity of robust mobile threat defense capable of zero-day behavior-based detection, since conventional defenses are often insufficient against malware that hides within legitimate traffic and infrastructure.