Zimperium details how ClayRat evolved from simple Android malware into a powerful surveillance tool, abusing accessibility, blocking removal, and screen capture
© A. Krivonosov
Researchers at Zimperium report a new, more sophisticated version of the Android malware ClayRat. Where the threat once acted as a basic infostealer pulling SMS and call logs, it has now evolved into a multipurpose surveillance tool with deeper system access and a built-in defense against removal. The shift feels like a troubling escalation that raises the stakes for everyday users.
Early variants spotted in fall 2024 were relatively limited. Now ClayRat taps Android accessibility services, allowing attackers to operate the device interface with few constraints. The toolkit has expanded to include keystroke logging, PIN capture, password reading, and even automatic screen unlock.
Specialists also point to a new anti-removal safeguard: ClayRat intercepts taps, blocks user commands, and swaps in actions to prevent powering off the phone or uninstalling the malware. On-screen, fake overlays may appear—such as a "system update" window—that hide what is really happening. That sleight of hand can leave users second-guessing what they see.
To spread, the trojan camouflages itself as popular apps: video service clients, messengers, and local taxi or parking services. Zimperium identified more than 25 lure domains, including counterfeit versions of YouTube Pro and Car Scanner ELM. The attackers also host APK files on Dropbox, thereby sidestepping security filters. Leaning on familiar brands and legitimate cloud storage makes the ruse feel more convincing.
Once installed, ClayRat gains near-complete control: it records the screen via the MediaProjection API, intercepts notifications, alters responses, and can steal one-time codes or meddle with conversations. With that foothold, even routine actions may not behave quite as expected.