ClayRat Android Spyware Variant Gains Full Device Control via Accessibility Abuse
A new variant of the ClayRat Android spyware has emerged, significantly enhancing its capabilities to seize full control of infected devices. Security researchers at Zimperium have detailed how this updated version now abuses Android's Accessibility Services in addition to requesting Default SMS privileges, enabling the malware to record lock screen credentials, capture screen activity, and automatically unlock devices. The spyware can also overlay fake system update screens, block user actions, disable Google Play Protect, and intercept sensitive information through custom notifications, making it much harder for victims to detect or remove the threat.
ClayRat continues to disguise itself as popular apps and local services, particularly targeting users in Russia, and is distributed through phishing sites and platforms like Dropbox. Over 700 unique malicious APKs have been identified, with the malware leveraging more than 25 fraudulent phishing domains to reach victims. The combination of advanced device control, sophisticated evasion techniques, and widespread distribution channels marks this ClayRat variant as a major escalation in Android spyware threats.
Related Entities
Malware
Sources
Related Stories
ClayRat Android Spyware Distributed via Fake Messaging and Social Media Apps
A sophisticated Android spyware campaign known as ClayRat has been identified targeting users in Russia by masquerading as popular applications such as WhatsApp, Google Photos, TikTok, and YouTube. Attackers employ a combination of phishing websites and Telegram channels to lure victims into downloading malicious APK files, often by imitating official app pages and inflating download statistics with fake testimonials. Once installed, ClayRat grants attackers extensive control over the infected device, enabling them to exfiltrate sensitive data including SMS messages, call logs, device information, and notifications. The spyware can also covertly take photos using the device’s front camera and initiate calls or send SMS messages without user consent. Researchers from Zimperium’s zLabs have observed that the malware propagates aggressively by sending malicious links to every contact in the victim’s phone book, leveraging compromised devices as distribution vectors. Over a three-month period, more than 600 unique samples and 50 dropper variants have been detected, with each iteration incorporating new obfuscation techniques to evade security defenses. Some versions of ClayRat act as droppers, presenting a fake Play Store update screen while installing the actual encrypted payload in the background. The campaign exploits Android’s default SMS handler role to bypass platform restrictions and facilitate rapid spread. In certain cases, fake websites offer a counterfeit “YouTube Plus” app with purported premium features, further enticing users to sideload the malware. The attackers’ use of Telegram channels, such as @baikalmoscow, as distribution hubs is notable for its effectiveness in social engineering. The campaign’s rapid evolution and high volume of unique samples indicate a well-resourced and persistent threat actor. Security researchers emphasize the importance of user vigilance, as the malware’s ability to bypass Google’s sideloading protections on Android 13 and later poses a significant risk. The campaign’s focus on Russian users suggests a degree of regional targeting, though the techniques employed could be adapted for broader attacks. The use of fake positive feedback and inflated download numbers on Telegram channels is designed to build trust and lower user skepticism. The technical sophistication of ClayRat, including its modular dropper architecture and obfuscation layers, presents challenges for traditional mobile security solutions. Organizations and individuals are advised to avoid downloading APKs from unofficial sources and to monitor for unusual device behavior. The ongoing development and distribution of ClayRat underscore the evolving threat landscape facing Android users, particularly in regions where sideloading is more common.
5 months agoActive Spyware Campaigns Targeting Mobile Messaging Apps and Android Devices
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an alert regarding a surge in sophisticated spyware campaigns targeting users of popular mobile messaging applications such as Signal, WhatsApp, and Telegram. Threat actors are leveraging commercial spyware and remote access trojans (RATs), employing tactics like social engineering, device-linking QR codes, zero-click exploits, and spoofed app versions to compromise high-value individuals, including government officials. Notable campaigns include the use of Android spyware like ProSpy, ToSpy, and ClayRat, as well as the exploitation of vulnerabilities in iOS, WhatsApp, and Samsung devices to deploy malware such as LANDFALL, with the goal of persistent access and data exfiltration. In a related development, researchers at Certo Software have identified a new Android RAT dubbed RadzaRat, which masquerades as a legitimate file manager app. RadzaRat provides attackers with full remote control over infected devices, supports large-scale file transfers, and features keylogging capabilities to steal sensitive information. Alarmingly, RadzaRat is currently undetectable by all major antivirus solutions and is openly available for download, increasing the risk of widespread abuse. These findings underscore the growing threat posed by advanced spyware and RATs targeting mobile platforms, often bypassing traditional security defenses and exploiting user trust in legitimate-looking applications.
3 months ago
Commercial Android RATs Abuse Accessibility Services for Full Device Takeover
Two newly reported Android **Remote Access Trojans (RATs)**—**SURXRAT** and **Oblivion**—highlight a continued shift toward *commercialized, subscription-based mobile malware* that enables non-expert criminals to gain full control of victim devices and exfiltrate data. Both threats are positioned as scalable offerings (i.e., **Malware-as-a-Service**) with structured sales models and distribution support, lowering the barrier to entry for surveillance, credential theft, and account takeover. The reported infection chains rely heavily on **social engineering** to trick users into installing or activating malicious components, then escalating control by abusing **Android Accessibility Services** to bypass normal interaction and security boundaries. SURXRAT is described as modular and stealth-focused, distributed primarily via **Telegram** channels with tiered licensing/reseller options, and capable of broad data access (e.g., SMS, contacts, location, storage) once high-risk permissions are granted. Oblivion is marketed at roughly **$300/month** (with longer-term pricing tiers) and is delivered via **fake Google Play update** prompts; researchers reported capabilities including SMS theft for banking codes, keylogging, remote unlocking after reboot, and covert live screen viewing while a decoy “system updating” animation distracts the victim, with infrastructure reportedly able to manage **1,000+** concurrent victims (including via Tor).
2 weeks ago