Researchers observed a new variant of the ClayRat Android spyware that abuses Accessibility Services and Default SMS privileges to perform keylogging, automatic lock-screen unlocking, screen recording, persistent overlays, fake interactive notifications, notification harvesting, camera capture, and mass SMS/call functionality. The campaign distributed over 700 unique APKs via phishing domains and cloud hosting (Dropbox), impersonating services like YouTube and Car Scanner ELM while Zimperium reports on-device protections detect and mitigate these attacks. #ClayRat #Zimperium
Keypoints
- New ClayRat variant leverages Android Accessibility Services in addition to Default SMS privileges to achieve full device takeover capabilities.
- Malware can capture PIN/password/pattern via keylogger and automatically unlock devices using dispatched gestures.
- Implements continuous screen recording via MediaProjection, VNC-like remote desktop, and WebSocket-based C2 communication.
- Uses overlays and fake interactive notifications to hide activity and steal user replies and credentials from targeted apps.
- Distributed through over 25 phishing domains and cloud hosting (Dropbox) with more than 700 unique APKs detected in a short period.
- Zimperium’s on-device defenses (MTD and zDefend) are cited as detecting known samples and protecting apps against these techniques.
MITRE Techniques
- [T1660 ] Phishing – Adversaries host phishing websites to distribute the spyware (‘phishing sites remain the primary distribution method’).
- [T1624.001 ] Event Triggered Execution: Broadcast Receivers – Malware registers broadcast receivers to process SMS and other events (‘It creates a broadcast receiver to receive SMS events’).
- [T1655.001 ] Masquerading: Match Legitimate Name or Location – Malware impersonates legitimate apps and services to avoid suspicion (‘Malware pretending to be apps such as Whatsapp,youtube etc’).
- [T1516 ] Input Injection – Malware programmatically mimics user interaction, performing clicks, swipes, and other gestures (‘Malware can mimic user interaction, perform clicks and various gestures, and input data’).
- [T1406.002 ] Obfuscated Files or Information: Software Packing – Uses obfuscation/packing and loads encrypted payloads at runtime (‘It is using obfuscation and loads the dex runtime’).
- [T1517 ] Access Notifications – Harvests active and interactive notifications for exfiltration (‘The malware can harvest interactive notifications and active notifications’).
- [T1417.001 ] Input Capture: Keylogging – Records keystrokes and lock-screen input via Accessibility events (‘It has a keylogger feature’).
- [T1417.002 ] Input Capture: GUI Input Capture – Captures displayed UI elements and input field contents through Accessibility Services (‘It is able to get the shown UI.’).
- [T1418 ] Software Discovery – Enumerates installed applications on the device (‘Malware collects installed application package list’).
- [T1426 ] System Information Discovery – Gathers device and battery information (‘The malware collects basic device info.’).
- [T1513 ] Screen Capture – Records or streams the device screen via MediaProjection and ImageReader (‘Malware can record screen content’).
- [T1512 ] Capture Camera – Takes pictures using the device camera (‘Malware opens camera and takes pictures’).
- [T1616 ] Call Control – Initiates and forwards calls from the victim device (‘Malware can make calls’).
- [T1636.002 ] Protected User Data: Call Log – Exfiltrates call logs from the device (‘Malware steals call logs’).
- [T1636.004 ] Protected User Data: SMS Messages – Reads and sends SMS messages from the infected device (‘Steals SMSs from the infected device’).
- [T1481.002 ] Web Service: Bidirectional Communication – Uses WebSocket-based communication for command-and-control and data transfer (‘It uses websocket communication to poll the TA’s server and get the commands to execute.’).
- [T1646 ] Exfiltration Over C2 Channel – Sends stolen data over the C2 channel to the attacker (‘Sending exfiltrated data over C&C server’).
- [T1582 ] SMS Control – Reads, resends, and sends SMS on behalf of the victim (‘It can read and send SMS.’).
Indicators of Compromise
- [Domains ] phishing distribution – phishing domains impersonating YouTube and Car Scanner ELM, and 23+ other fraudulent domains.
- [APK files ] sideloaded installers – 700+ unique APKs used to install ClayRat, including APKs hosted via Dropbox and phishing site links.
- [Cloud storage URLs ] malware hosting – Dropbox shared links used to distribute malicious APKs (example: Dropbox-hosted APKs).
- [User-Agent strings ] C2/telemetry artifacts – ‘ClayRemoteDesktop’ user agent observed when switching to WebSocket streaming.
- [Application artifacts ] on-device indicators – encrypted payload in the app assets folder (AES/CBC) and SharedPreferences key ‘lock_password_storage’ storing stolen lock credentials.
Read more: https://zimperium.com/blog/return-of-clayrat-expanded-features-and-techniques