ClayRat Android spyware evolves, threatens full device takeover

A new and significantly more dangerous version of the ClayRat Android spyware has emerged, capable of performing a full device takeover. Mobile security firm Zimperium has released an update detailing the spyware's enhanced capabilities, making it a substantial threat to users. This advanced spyware can steal sensitive data and gain complete control over infected devices, as reported by HackRead.

Initially discovered in October 2025 by Zimperium's zLabs, ClayRat targeted Russian users by impersonating popular applications like WhatsApp and Google Photos. The updated version continues this tactic, mimicking local Russian apps and services. Its primary danger lies in its abuse of Android's Accessibility Services. After gaining SMS privileges, it prompts users to enable Accessibility Services, which then allows it to record lock screen credentials (PINs, passwords, patterns), capture entire screen activity and block users with fake screens like "System Update" notices. It can also disable Google Play Protect to prevent removal and intercept typed information through fake custom messages.

The aggressive spread of ClayRat, with over 700 unique versions observed and distributed via phishing domains and Dropbox, poses a significant risk to businesses due to employees using personal devices for work. Users are advised to download apps exclusively from the Google Play Store and exercise extreme caution when granting permissions, particularly for Accessibility Services, to mitigate the risk of infection.

Source: HackRead