ClayRat Spyware Campaign Targets Android Users via Telegram and Fake WhatsApp, TikTok, YouTube Sites
Published
- Primary target: A rapidly evolving Android spyware campaign, named ClayRat, is primarily targeting users in Russia.
- Distribution method: The spyware is distributed through Telegram channels and phishing websites that impersonate WhatsApp, TikTok, and more.
- Key threat vector: ClayRat exploits Android’s default SMS handler role to obtain extensive permissions without triggering standard security prompts.
A rapidly expanding Android spyware campaign known as ClayRat propagates malware through a highly organized combination of social engineering and web-based deception. Attackers leverage channels on popular messaging apps and carefully crafted phishing sites that mimic legitimate services to trick users into downloading and installing malicious APKs.
Extensive Surveillance Capabilities
An Android spyware campaign utilizes Telegram channels and phishing websites that impersonate popular applications, including WhatsApp, TikTok, Google Photos, and YouTube. To enhance credibility, these channels often feature fake user testimonials and inflated download counts, according to recent research by Zimperium.
Researchers warn that ClayRat is expanding at an alarming rate, with more than 600 samples and 50 droppers having been observed in the past three months alone, “each iteration adding new layers of obfuscation and packing to evade detection.”
Once installed on a device, the ClayRat spyware possesses extensive surveillance capabilities and can:
- exfiltrate sensitive user data, including:
- SMS messages,
- call logs,
- notifications,
- detailed device information.
- covertly take pictures using the device's front-facing camera
- even send SMS messages or place calls directly from the victim’s device
This deep level of access turns a personal device into a comprehensive surveillance tool.
Some variants of the spyware act as droppers, presenting a fake Google Play update screen while a hidden, encrypted payload is installed, bypassing Android 13's security restrictions.
“ClayRat demonstrates how attackers are evolving faster than ever, combining social engineering, self-propagation, and system abuse to maximize reach,” said Shridhar Mittal, CEO of Zimperium.
Self-Propagation and Mobile Security Threats
One of ClayRat's most potent features is its self-propagation mechanism. By gaining permissions as the default SMS handler, the malware can send malicious links to every contact stored on the victim’s phone.
This technique effectively weaponizes the victim's social network, turning each infected device into an automated distribution node and fueling the campaign's exponential growth.
The abuse of the SMS handler role represents one of the significant mobile security threats posed by this malware, as it consolidates powerful permissions into a single authorization step, bypassing many standard user-facing security warnings.
Besides remaining wary as an end user, Chrissa Constantine, Senior Cybersecurity Solution Architect at Black Duck, recommends organisations to train and educate employees to avoid falling prey to social engineering and “ensure that employees understand the importance of not loading apps from untrusted sources, especially on work devices.”
A layered mobile security posture that reduces installation paths, detects compromise, and limits blast radius is recommended by Sectigo’s Jason Soroko. “Teams should also block sideloading through Android Enterprise policy and allow only managed Google Play installs and monitor for any change to the default SMS app, then block or alert on unauthorized handlers.”
This type of RAT technology can also be used to “engage in even more sophisticated impersonation attacks,” warns Bambenek Consulting President John Bambenek.
A few months ago, Android malware used energy subsidy promises in India to steal financial data, and a Telegram APK campaign exploited fake domains and Android vulnerabilities.
Related
Get expert insights on threats, breaches, scams, and security trends — delivered every Saturday.
Most Popular
Get expert insights on threats, breaches, scams, and security trends — delivered every Saturday.
Most Popular