ClayRat Android Malware Masquerades as WhatsApp & Google Photos

ClayRat is an Android spyware campaign that has surged in activity over the past three months, with zLabs researchers observing more than 600 unique samples and 50 distinct droppers. It mainly targets Russian users and masquerades as popular apps such as WhatsApp, Google Photos, TikTok, and YouTube, luring victims via deceptive Telegram channels and phishing sites.

Once installed, it exfiltrates SMS messages, call logs, notifications and device information, can capture photos with the front camera, and can send SMS messages or place calls from the victim’s device, turning each infection into a powerful surveillance hub. Attackers register lookalike domains to redirect visitors to Telegram channels where the malicious APK is hosted, and the campaigns use staged social proof to boost installation rates.

Zimperium notes that ClayRat has been detected from its earliest samples, with on‑device behavioural ML models used to identify anomalous activity before signature updates are released. The malware also uses obfuscation and encryption to hide its payload and employs a fake Google Play update interface while loading an encrypted spyware module.