Full Report
A new Android spyware called ClayRat is luring potential victims by posing as popular apps and services like WhatsApp, Google Photos, TikTok, and YouTube. [...]
Analysis Summary
# Tool/Technique: ClayRat
## Overview
ClayRat is a new Android spyware primarily targeting Russian users by masquerading as popular applications (e.g., WhatsApp, Google Photos, TikTok, YouTube) through malicious websites and Telegram channels. Its purpose is to compromise Android devices, steal sensitive data, and propagate itself to the victim's contact list.
## Technical Details
- Type: Malware family (Spyware)
- Platform: Android
- Capabilities: SMS interception/theft, call log exfiltration, notification capture, camera access (photo taking), initiating phone calls, mass SMS sending for propagation, device information gathering, and establishing WebSocket communication via proxying HTTP/HTTPS traffic.
- First Seen: The campaign was documented over the three months leading up to October 2025.
## MITRE ATT&CK Mapping
No explicit MITRE ATT&CK mappings were detailed in the provided text, but based on its capabilities, the following are highly likely:
- **TA0001 - Initial Access**
- T1189 - Drive-by Compromise (Via malicious websites/phishing)
- **TA0005 - Defense Evasion**
- T1204.002 - User Execution: Malicious File
- **TA0009 - Collection**
- T1429 - Information from Application Software
- T1430 - Input Capture
- **TA0010 - Exfiltration**
- T1041 - Exfiltration Over C2 Channel
- **TA0011 - Command and Control**
- T1071 - Application Layer Protocol
- **TA0003 - Persistence**
- T1462 - New Service (Potentially via masquerading as updates)
## Functionality
### Core Capabilities
- Assume the default SMS handler role to read, intercept, and modify SMS messages.
- Exfiltrate SMS message lists (`get_sms_list`).
- Exfiltrate call logs (`get_calls`).
- Steal notifications and push data (`notifications / get_push_notifications`).
- Collect device information (`get_device_info`).
### Advanced Features
- **Session-based installation method:** Used to bypass Android 13+ restrictions, lowering user suspicion.
- **Masquerading:** Imitates legitimate, popular apps (WhatsApp, TikTok, etc.) via phishing portals designed to look like official app stores (e.g., fake Play Store UX).
- **Self-Propagation:** Automatically harvests contacts and sends mass SMS messages to them (`messsms`), using the device as a springboard.
- **C2 Communication:** Uses AES-GCM encrypted communication in latest versions.
- **Proxying:** Can fetch a proxy WebSocket URL and convert HTTP/HTTPS traffic to WebSocket for command scheduling (`get_proxy_data`).
- **Remote Actions:** Capture front-camera photos (`get_camera`), send SMS (`send_sms`), and place calls (`make_call`).
## Indicators of Compromise
- File Hashes: Not provided in the text.
- File Names: Android Package Files (APKs) disguised as popular apps.
- Registry Keys: Not applicable (Android).
- Network Indicators: C2 servers associated with the "ClayRat" campaign (Specific addresses defanged).
- Behavioral Indicators:
- Requesting to become the default SMS handler.
- Application displaying a fake Play Store update screen upon launch.
- Sending mass, unsought SMS messages to the entire contact list.
## Associated Threat Actors
- Not explicitly named, but the operation is attributed to the actors behind the "ClayRat campaign."
## Detection Methods
- Signature-based detection: Play Protect now blocks known and new variants due to sharing IoCs with Google.
- Behavioral detection: Monitoring for apps hijacking the default SMS handler role or massive SMS propagation activities.
- YARA rules: Not provided in the text, but likely available via Zimperium.
## Mitigation Strategies
- **User Education:** Victims must be wary of downloading APKs outside official channels or responding to requests to sideload applications.
- **Security Updates:** Staying updated with the latest Android OS versions (though the malware attempts to bypass restrictions on newer versions).
- **System Hardening:** Avoiding granting SMS handling privileges to untrusted applications.
- **Monitoring:** Actively monitoring for applications attempting to set themselves as the default SMS application.
## Related Tools/Techniques
- Other session-based or update masquerading malware designed to bypass modern Android security features.
- Android spyware families that hijack the default SMS handler.