Cellik Android malware builds malicious versions from Google Play apps

A new Android malware-as-a-service called Cellik is being sold on underground forums and advertises features to trojanize Google Play apps. It offers real-time screen streaming, notification interception, a hidden browser that can use stolen cookies, app injection/overlay attacks for credential theft, file exfiltration and device-wipe capabilities, and an APK builder that claims integration with Google Play to wrap malicious payloads in legitimate apps; Google reports no known Play Store infections at this time.