ClayRat campaign uses Telegram and phishing sites to distribute Android spyware

ClayRat Android spyware targets Russian users via fake Telegram channels and phishing sites posing as popular apps like Google Photos, WhatsApp, TikTok and YouTube. Zimperium named the spyware ClayRat after its C2 server, and researchers observed over 600 samples and more than 50 droppers in three months, with each dropper adding obfuscation and packing to evade detection. The malware also abuses Android’s default SMS handler to bypass permission prompts and quietly access sensitive data.

ClayRat spreads through a mix of social engineering and web deception, using Telegram channels and phishing sites mimicking legitimate services to host fake APKs with step-by-step install guides that bypass Android warnings. Telegram channels are seeded with fake reviews and inflated statistics to boost reach, while phishing sites mimic popular apps and distribute fake APKs that can act as droppers showing fake update screens.

Once installed, it auto-sends malicious SMS to all contacts, turning each device into a distribution node, and it payloads are loaded after obfuscation using a marker in Base64-encoded data, with variants using AES-GCM for C2 traffic. According to Zimperium, the campaign’s scale underscores how rapidly the mobile threat landscape is changing.