Return of ClayRat: Expanded Features and Techniques
ID: 6c6420a2-6f34-5e8f-aa61-945048152dbc
STIX ID: report--6c6420a2-6f34-5e8f-aa61-945048152dbc
Feed Name: Zimperium Blog
Threat Score
ClayRat v3.0.8 is an upgraded Android spyware campaign that abuses Accessibility Services and Default SMS privileges to achieve near-full device takeover. It captures lock-screen credentials (PIN/password/pattern), records the screen via MediaProjection, places persistent overlays, intercepts notifications and replies, exfiltrates SMS/call logs/photos, and offers remote-control features via WebSocket/VNC; over 700 unique APKs and multiple phishing domains (plus cloud-hosted distribution) were observed.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.