New $150 Cellik RAT Grants Android Control, Trojanizes Google Play Apps

SecurityWeek reports that a newly identified Android remote access trojan, named Cellik, offers a one-click APK builder to wrap its payload inside legitimate apps and even includes Google Play integration to enable attackers to bundle malicious code with popular apps. The malware provides full device control and real-time surveillance capabilities, including screen streaming, keylogging, remote camera and microphone access, notification interception, data stealing from other apps, and hidden browsing.

It can display overlays on top of other applications and uses an injector lab to support multiple simultaneous injections across apps, with a hidden browser module that operates invisibly on the device. Cellik’s Play Store integration allows threat actors to browse the app catalog and repackage legitimate apps with the malicious payload, all controlled via its built-in toolkit.

The malware is marketed on the dark web at $150 per month, with a one-month subscription including RDP priced at $200 and a lifetime option at $900. According to iVerify, it also offers advanced capabilities such as real-time location tracking, crypto-wallet theft, and AI-driven analysis of user behaviour. 17 December 2025.