The Silent Hijacker: New Cellik Android RAT Turns Legitimate Google Play Apps into Surveillance Tools

A new Android Remote Access Trojan called Cellik has emerged, offering a ready-made spyware package that piggybacks on legitimate Google Play Store apps to hijack smartphones. According to iVerify, Cellik is marketed as a comprehensive spyware MaaS platform, with a subscription starting at $150 per month that unlocks a dashboard mirroring state-sponsored tools.

The malware bundles capabilities such as real-time screen streaming, keylogging, remote camera and microphone access, hidden web browsing, and an app-injection system to steal data from other apps. It also features a VNC-like remote control of the victim’s device and an automated APK Builder that lets attackers inject Cellik into popular legitimate apps from the Play Store.

By wrapping its payload in trusted apps, the operators claim it can bypass Play Protect and other security filters, enabling easier installation. The platform is advertised with a lifetime license at $900, positioning it within a broader trend of affordable, turnkey Android malware for threat actors to deploy covert surveillance campaigns. 22 December 2025.