'Cellik' Android RAT Leverages Google Play Store

Cellik is a RAT-as-a-service that leverages the Google Play Store to build poisoned versions of Android apps, allowing an attacker to remotely control a victim’s device. The malware can generate malicious apps inside the Play Store and, once installed, provides the attacker with complete device control, including streaming the screen and accessing files, passwords, and browser data.

Kelley wrote that the RAT can bypass Google Play security features by wrapping its payload in trusted apps, which can slip past automated reviews or device-level scanners.

The Play Store integration includes an automatic .apk builder that can browse legitimate apps, wrap a Cellik payload, and package it for distribution to other victims. iVerify’s blog notes that Cellik is part of a growing x-as-a-service ecosystem where low-level criminals can buy turnkey malware and related infrastructure, with the price for Cellik ranging from $150 a month to $900 for a lifetime subscription.

According to iVerify, social engineering and sideloading remain common delivery methods, with attackers often exploiting user trust rather than exploiting technical flaws. December 17, 2025.