New ClayRat Spyware Targets Android Users via Fake WhatsApp and TikTok Apps

A rapidly evolving Android spyware campaign called ClayRat has targeted users in Russia, using Telegram channels and lookalike phishing websites that impersonate popular apps such as WhatsApp, Google Photos, TikTok and YouTube as lures to install the malware.

According to Zimperium researcher Vishnu Pratapagiri, once active the spyware can exfiltrate SMS messages, call logs, notifications and device information, take photos with the front camera, and even send SMS messages or place calls directly from the victim’s device. The campaign also propagates itself by sending malicious links to every contact in the victim’s phone book, a tactic aimed at expanding distribution.

The developers have detected no fewer than 600 samples and 50 droppers in the last 90 days, with each iteration adding obfuscation to evade detection. Some ClayRat samples act as droppers, presenting a fake Play Store update screen while the encrypted payload is hidden in the app’s assets. Communication with the attack infrastructure uses standard HTTP to reach the C2 server, and the malware can request to be set as the default SMS app to access sensitive content and messaging functions.