Evolved ClayRat Spyware Gains Self-Defense, Using Accessibility Abuse to Block Uninstallation and Steal Keys

According to Zimperium’s zLabs, the ClayRat Android spyware family has resurfaced with upgraded capabilities, evolving from a data thief into a capable surveillance tool that can actively defend itself against removal. The new variant leverages Accessibility Services in addition to exploiting Default SMS privileges, gaining near-total control over the device interface.

It includes a keylogger to record pin, password, and pattern and can automatically unlock the lockscreen, while also using programmatic button-tapping to thwart attempts to uninstall the app. The malware places overlays on the victim’s screen, such as a system update overlay, to deter interaction while it runs in the background.

It masquerades as legitimate apps and has hosted over 25 fraudulent phishing domains, with lures including YouTube Pro and Car Scanner ELM, and distributes via Dropbox to bypass web filters. Once installed, ClayRat can perform screen recording through the MediaProjection API and creates fake notifications to intercept replies, enabling broader spying capabilities, a step up from its previous version.