Zimperium's zLabs team has uncovered a new, enhanced version of the ClayRat spyware on Android devices. Building upon research initially presented in October 2025, this sophisticated iteration poses a significant threat by advancing its capabilities and stealth compared to its predecessor.
Initially, ClayRat was identified for its ability to clandestinely gather SMS messages, call logs, and other personal data, turning compromised devices into potential hubs for distribution.
Enhanced Functionalities Increase Threat Level
The latest variant marks a considerable escalation, utilizing Default SMS privileges and Accessibility Services to compromise device security further. This version can now capture lock-screen credentials and activate the device without user input. By using the MediaProjection API, it records screens and uses deceptive overlays to prevent detection. Additionally, it can simulate taps, making it harder for users to shut down or remove the application. The spyware also generates false notifications to intercept and exfiltrate responses.
This expanded range of abilities allows for complete control over infected devices, elevating the risk posed to corporate data and private information. The capacity to capture sensitive data like corporate credentials and MFA codes through hijacked communication channels makes it a serious concern for organizations.
Phishing and Social Engineering Tactics
ClayRat continues to exploit phishing tactics, disguising itself as well-known apps, including popular video
ClayRat continues to exploit phishing tactics, disguising itself as well-known apps, including popular video and messaging platforms. It also targets region-specific services such as certain Russian taxi and parking applications.
The distribution heavily relies on phishing webpages and sideloaded APKs, with platforms like Dropbox frequently used as vectors. Zimperium’s telemetry indicates over 700 unique APKs related to ClayRat have emerged in a short period.
Implications for BYOD Policies
According to Vishnu Pratapagiri, lead researcher at zLabs, “ClayRat’s evolution shows exactly why enterprises need protection that works at the device level, not just network-based.” With its ability to exploit Android functions and conceal malicious operations, ClayRat turns Android devices into compromised endpoints, rendering traditional defenses ineffective.
The increasing sophistication of ClayRat underscores the vulnerability of mobile devices, particularly in "Bring Your Own Device" (BYOD) environments. Enterprises are urged to remain vigilant and consider ClayRat's advancing capabilities as a stark warning. Zimperium is continually monitoring these developments and sharing threat information with industry partners.
Learn why leading casinos are upgrading to smarter, faster, and more compliant systems
