- ClayRat impersonates apps such as WhatsApp and TikTok to infect Android phones through APKs.
- It is distributed through fake sites that mimic the Play Store and Telegram channels.
- Uses session-based installation to bypass Android 13+ defenses and sets itself as an SMS app.
- It steals SMS messages, calls, and photos, and spreads to contacts; these are the keys to avoiding infection.
Researchers at the mobile security firm Zimperium have observed a growing campaign with over 600 detected samples and 50 implicated droppers , distributed through Telegram channels and fraudulent websites that mimic legitimate portals. Its reach and intensive use of social engineering make it a particularly active threat in the Android ecosystem , similar to cases like Pegasus.
This is how it is distributed: spoofing apps and fake websites
The campaign operators create websites that mimic the Google Play Store and official pages of apps like WhatsApp, TikTok, YouTube, and Google Photos. These sites display fake reviews, inflated download counters, and automated comments to gain trust.
From these websites, victims are invited to download malicious APKs disguised as updates or premium versions. In many cases, the actual download is hosted on Telegram channels controlled by the attackers, where instructions for completing the installation are provided.
To increase the success rate, scammers instruct users to install apps from unknown sources and follow steps that mimic those of a legitimate app. This script reduces suspicion and helps the infection go undetected.
The activity has been observed notably in Russian territory , although there are no guarantees that its reach will remain limited over time. The combination of visual impersonation and instant messaging facilitates its expansion to other markets.
An installation process that bypasses Android 13 and later
One of the most striking technical features is the use of a session-based installation mechanism , which replicates the installation flow of real apps to minimize alerts. This allows it to circumvent some of the restrictions introduced in Android 13 and later versions.
Several samples function as droppers: they display a fake Play Store update screen while, in the background, they download and execute the encrypted malicious payload. The experience appears legitimate, but the result is the entry of spyware into the system.
After installation, ClayRat hides among other processes and communicates with its command and control (C2) server using AES-GCM encryption and sending data in fragments. This tactic makes it difficult to detect using conventional security solutions.
What ClayRat can do to your compromised phone
The malware requests extensive permissions and, once granted, attempts to set itself as the default SMS app . This allows it to read, intercept, modify, and send messages, as well as interfere with notifications received by messaging apps.
Its capabilities include capturing photos with the front camera without user intervention , accessing call logs, enumerating installed apps, collecting device and network data, and even making calls and sending SMS messages.
- List of installed applications (get_apps_list).
- Call history (get_calls).
- Capturing images with the front camera (get_camera).
- Mass reading and sending of SMS (get_sms_list / messms).
- Make calls and send messages from the terminal (send_sms / make_call).
- Device and network data collection (get_device_info).
- Encapsulating HTTP/HTTPS traffic in WebSocket tunnels to hide connections (get_proxy_data).
Furthermore, ClayRat leverages the user as a propagation vehicle : it automatically sends download links to all contacts, multiplying infections with minimal intervention from the attackers.
Mitigation and response measures
The first barrier is common sense: download and install apps only from the Google Play Store , avoid modified or supposedly premium versions, and be wary of any updates offered outside the official store.
On a daily basis, frequently review the permissions granted and check which app is set as the default SMS client. If you detect anything suspicious, revoke permissions, uninstall the app, and scan your device with Play Protect or another reputable security solution.
In corporate environments, it is advisable to implement MDM/EMM policies to block sideloading , enforce device integrity, and monitor app behavior, in addition to training staff in spoofing detection.
Research status and scope
Zimperium has cataloged this family by the server name C2 and confirms sustained activity with multiple variants , reminiscent of threats like KOSPY . Specialized media outlets have warned of its evolution and the intensive use of visual spoofing and Telegram channels as an entry point.
ClayRat paints a clear picture: spyware masquerading as WhatsApp and TikTok exploits installations from outside the app store, reduces red flags, and steals data with great stealth while spreading among contacts. Keeping downloads from official channels, monitoring permissions, and not granting critical privileges to unknown apps remains the most effective strategy for staying safe.
