ClayRat: A New Android Spyware Targeting Russia

ClayRat is an Android spyware campaign primarily targeting Russian users by masquerading as popular apps distributed through Telegram channels and phishing sites. It exfiltrates SMS, call logs, notifications, device info, takes photos, and sends SMS messages. The malware spreads aggressively by sending malicious links to victims' contacts, leveraging Android's default SMS handler role to bypass permission prompts. Over 600 samples and 50 droppers have been observed in three months, with continuous obfuscation improvements. The campaign uses impersonation, community distribution, UX deception, and self-propagation via SMS forwarding. While currently focused on Russia, the techniques and propagation methods pose risks to European organizations with Android users. No known exploits are publicly reported, and the campaign requires user interaction to install and propagate. Suggested severity is medium due to its impact on confidentiality and propagation capabilities but limited to targeted regions and requiring user action.

• Microsoft Teams to get AI-powered, context-aware phishing detectionNews2026-10-23
• Technology that blocks DGA domains | Kaspersky official blogAnalysis2026-10-23
• 2026 Year End Phishing LuresCampaign2026-10-22
• Machine speed attacks require machine speed detection and responseAnalysis2026-10-22
• How Tenable brought multi-language support to security detectors with agentic translationAnalysis2026-10-21