A rapidly evolving Android spyware campaign called ClayRat has targeted users in Russia using a mix of Telegram channels and lookalike phishing websites by impersonating popular apps like WhatsApp, Google Photos, TikTok, and YouTube as lures to install them.
"Once active, the spyware can exfiltrate SMS messages, call logs, notifications, and device information; taking photos with the front camera; and even send SMS messages or place calls directly from the victim's device," Zimperium researcher Vishnu Pratapagiri said in a report shared with The Hacker News.
The malware is also designed to propagate itself by sending malicious links to every contact in the victim's phone book, indicating aggressive tactics on the part of the attackers to leverage compromised devices as a distribution vector.
The mobile security company said it has detected no less than 600 samples and 50 droppers over the last 90 days, with each successive iteration incorporating new layers of obfuscation to sidestep detection efforts and stay ahead of security defenses. The malware name is a reference to the command-and-control (C2) panel that can be used to remotely administer the infected devices.
The attack chain involves redirecting unsuspecting visitors to these bogus sites to Telegram channels under the adversary's control, from where they are tricked into downloading APK files by artificially inflating download counts and sharing manufactured testimonials as proof of their popularity.
In other cases, bogus websites claiming to offer "YouTube Plus" with premium features have been found to host APK files that can bypass security protections enforced by Google to prevent sideloading of apps on devices running Android 13 and later.
"To bypass platform restrictions and the added friction introduced in newer Android versions, some ClayRat samples act as droppers: the visible app is merely a lightweight installer that displays a fake Play Store update screen, while the actual encrypted payload is hidden within the app's assets," the company said. "This session-based installation method lowers perceived risk and increases the likelihood that a webpage visit will result in spyware being installed."
Once installed, ClayRat uses standard HTTP to communicate with its C2 infrastructure and requests users to make it the default SMS application to gain access to sensitive content and messaging functions, thereby allowing it to covertly capture call logs, text messages, notifications, and disseminate the malware further to every other contact.
Some of the other features of the malware include making phone calls, getting device information, taking pictures using the device camera, and sending a list of all installed applications to the C2 server.
ClayRat is a potent threat not only for its surveillance capabilities, but also for its ability to turn an infected device into a distribution node in an automated fashion, which enables the threat actors to expand their reach swiftly without any manual intervention.
A Google spokesperson told The Hacker News that Android users are automatically safeguarded against known versions of the malware through Google Play Protect, which is enabled by default on devices with Google Play Services.
The development comes as academics from the University of Luxembourg and Université Cheikh Anta Diop found that pre-installed apps from budget Android smartphones sold in Africa operate with elevated privileges, with one vendor-supplied package transmitting device identifiers and location details to an external third-party.
The study examined 1,544 APKs collected from seven African smartphones, finding that "145 applications (9%) disclose sensitive data, 249 (16%) expose critical components without sufficient safeguards, and many present additional risks: 226 execute privileged or dangerous commands, 79 interact with SMS messages (read, send, or delete), and 33 perform silent installation operations."
(The story was updated after publication to include a response from Google.)
