A new Android Remote Access Trojan (RAT) named Glitch SPY has been detected, targeting individuals in Poland through fake rental property websites. It is delivered via a loader that disguises itself as a rental app, requesting permission to install from unknown sources. Once installed, Glitch SPY leverages the Accessibility Service to gain extensive control over the device, enabling functionalities like screen streaming, keylogging, and data theft.
The malware uses a persistent connection to its command server and includes features such as a crypto-clipper that substitutes cryptocurrency wallet addresses. Users are advised to avoid installing apps from unofficial sources and to be cautious with accessibility permissions.