ClayRat Android spyware targets Russia via fake channels and phishing

Security researchers have identified a rapidly evolving Android spyware campaign, known as ClayRat, that has been targeting users in Russia through fake Telegram channels and phishing websites and has produced more than 600 distinct samples and roughly 50 dropper variants in the past three months. Researchers say the malware is distributed via sites and channels that impersonate widely used apps such as TikTok, YouTube, Google Photos and WhatsApp and lure victims into sideloading malicious APKs by presenting forged reviews, inflated download counts and step‑by‑step installation instructions.

Zimperium zLabs, which named the spyware after the label on its command‑and‑control server login form, reported that ClayRat variants increasingly employ obfuscation and packing to evade detection. Several versions act as droppers that show fake update or installer screens while loading an encrypted payload from within the app. Once installed, the malware requests that it be made the device's default SMS handler, a role that researchers say allows it to read, send and intercept text messages without triggering standard runtime permission prompts.

Abuse of SMS handling privileges is central...