New Android spyware ClayRat imitates WhatsApp, TikTok, YouTube

A new Android spyware called ClayRat is luring potential victims by posing as popular apps and services like WhatsApp, Google Photos, TikTok, and YouTube. The malware is targeting Russian users through Telegram channels and malicious websites that appear legitimate. It can steal SMS meessages call logs, notifications, take pictures, and even make phone calls. Malware researchers at mobile security company Zimperium say that they documented more than 600 samples and 50 distinct droppers over the past three months, indicating an active effort from the attacker to amplify the operation. The ClayRat campaign, named after the malware’s command and control (C2) server, uses carefully crafted phishing portals and registered domains that closely mimic legitimate service pages. These sites host or redirect visitors to Telegram channels where the Android package files (APKs) are provided to unsuspecting victims. To add legitimacy to these sites, the threat actors have added fake comments, inflated download counts, and used a bogus Play Store-like UX with step-by-step instructions on how to sideload APKs and bypass Android’s security warnings. According to Zimperium, some ClayRat malware samples act as droppers, where the app the user sees is a fake Play Store update screen and an encrypted payload is hidden in the app's assets. The malware nests in the device using a “session-based” installation method to bypass Android 13+ restrictions and reduce user suspicion. "This session-based i...