Android devices are being targeted by a new malicious strain called ClayRat, which disguises itself as popular apps and services — including WhatsApp, Google Photos, TikTok and YouTube — and can steal SMS messages, call logs, notifications and even take photos via the phone’s camera.
Security site Bleeping Computer reports that the new Android malware ClayRat is hiding behind familiar app icons and services to infect users. Once installed, the malware can exfiltrate SMS messages, call logs, notifications and remotely capture images from the device’s camera.
The campaign currently appears to target Russian users, spreading through Telegram channels and malicious websites that host infected versions of well-known apps. Mobile-security firm Zimperium says it has tracked more than 600 attacks using ClayRat and identified around 50 infected apps over the past three months.
In some cases the malware is distributed as what looks like an update to an app already installed on the device; in other cases it’s offered via third-party app stores and Telegram channels that deliver apps outside the official Google Play store.
After installation, ClayRat propagates by sending malicious files to all contacts on the victim’s phone, because it takes over the device’s SMS services. Zimperium shared its findings with Google to help block and remove the threat, and Google has begun preventing installs through Play Protect.
The attack is currently limited to Android devices because it relies on installing apps from outside Google Play — a vector not available on Apple’s iPhones.
