ClayRat
ClayRat is an Android spyware / remote access trojan (RAT) family used for covert surveillance and remote control of infected devices. It was first publicly identified in October 2025 and was primarily observed targeting Android users in Russia, though later reporting described broader spread. Distribution relied on phishing sites and counterfeit apps impersonating popular services and apps including WhatsApp, TikTok, YouTube, Google Photos, Telegram, and Russian taxi and parking apps; Telegram channels were also used to seed malicious APKs. Some samples acted as droppers, displaying a fake Google Play Store update screen while decrypting and installing a hidden payload from the app assets to bypass newer Android sideloading restrictions.
Documented capabilities include interception of SMS messages, call logs, notifications, and contacts; collection of device information and installed app lists; taking photos with the device camera; screen capture and screen recording; keylogging / recording keystrokes; placing calls; sending SMS, including mass SMS to contacts; harvesting lock-screen credentials such as PINs, passwords, and patterns; and executing commands from a remote command-and-control server over WebSocket. Newer variants abused Android Accessibility Services and default SMS privileges to automate screen interaction, unlock devices, disable Google Play Protect, display fake overlays such as system update screens, create fake interactive notifications to steal user responses, and block uninstallation or device shutdown. Reporting described these upgrades as enabling near full device takeover.
Analysis of exposed ClayRat backend infrastructure showed an unobfuscated Go 1.24 web panel used for device management and APK generation. The panel stored configuration and user data in JSON files, including plaintext credentials and operational tokens, and supported functions such as device telemetry, SMS parsing, screenshot capture, screen viewing, camera access, call initiation, Telegram/SMS relay, and malicious APK building. The APK template contained constants referencing clay.kpmail[.]su, including ws://clay.kpmail[.]su/ws/android and http://clay.kpmail[.]su/, and a telemetry endpoint http://error[.]clayhusas[.]sbs:5654/error. Reporting also noted overlap or reuse involving the kpmail[.]su domain family and DCRAT indicators.
Zimperium reported rapid growth, identifying more than 600-700 unique ClayRat samples and roughly 50 droppers over a short period, with over 25 phishing domains used in distribution. ClayRat has also been referenced in reporting on mobile spyware threats affecting messaging-app users and in Telegram-based cybercrime ecosystems linked to CrackRat Zone Clay and RasCorp Group. By December 2025, researchers reported that all known ClayRat command-and-control servers were offline. Open-source reporting linked the apparent collapse or abandonment of the operation to poor operational security and to the detention in Krasnodar of a student suspected of developing and marketing the malware via Telegram.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
While examining the structure of the Persephone website and the groups referenced within it, RasCorp Group appeared alongside VFVCT and ClayRat... One such announcement described a strategic alliance between three groups: CrackRat Zone Clay, RasCorp Group, and VFVCT... CrackRat Zone Clay as developers of multifunctional tools.
While examining the structure of the Persephone website and the groups referenced within it, RasCorp Group appeared alongside VFVCT and ClayRat... One such announcement described a strategic alliance between three groups: CrackRat Zone Clay, RasCorp Group, and VFVCT... CrackRat Zone Clay as developers of multifunctional tools.
Techniques & procedures
16 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique
Initial Access
Execution
2 techniques
Execution
Persistence
1 technique
Persistence
Privilege Escalation
1 technique
Privilege Escalation
Stealth
2 techniques
Stealth
Credential Access
2 techniques
Credential Access
Collection
4 techniques
Collection
ClayRat not only permitted phone calls and device data collection, but also photo capturing and app list delivery to the attacker-controlled command-and-control server.
Command and Control
3 techniques
Command and Control
.field public static final WEBSOCKET_URL :Ljava/lang/String ; = "ws://clay.kpmail.su/ws/android" | Вредонос способен ... отправлять команды с сервера управления (C2).
Exfiltration
1 technique
Exfiltration
IOCs tracked for this family
41 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
31 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Android spyware and remote access trojan used for espionage and remote control of infected devices, with capabilities including SMS and call log interception, contact access, photo capture, screen recording, and remote command execution.
Tooling associated with the RasCorp/VFVCT alliance, described as providing advanced multifunctional tools within the broader ransomware-oriented ecosystem.
Named as one of 17 Android malware families detected in the wild over four months.
Android spyware/RAT used for covert surveillance and remote control of infected devices. It can intercept SMS messages and call logs, access contacts, take photos, record the screen, receive commands from a C2 server, relay SMS, and generate malicious APKs via a builder-backed infrastructure.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.