ClayRat Malware — Analysis, Campaigns & Threat Activity

Threat entity extracted from intelligence sources

Frequency
10
occurrences
First Seen
November 11, 2025
Last Seen
May 20, 2026

Related Threat Clusters

  • 2026 Smartphone Security Threats: Zero-Click Exploits and Banking Trojans Rise

    In May 2026, a critical Android vulnerability (CVE-2026-0073) was disclosed, allowing remote device takeover without user interaction. This flaw, linked to the Android Debug Bridge, affects devices with ADB enabled,…

    2 articles · Updated May 23, 2026
  • New Variant of ClayRat Android Malware Targets SMS, Call Logs, and Photos

    Security researchers at Zimperium's zLabs have identified a new variant of the ClayRat malware affecting Android devices. This malware is capable of stealing SMS messages, call logs, and capturing photos from victims'…

    3 articles · Updated December 5, 2025
  • Marquis Data Breach Affects Multiple U.S. Banks and Credit Unions

    A data breach involving fintech firm Marquis has compromised the information of dozens of U.S. banks and credit unions. The incident was triggered by a zero-day vulnerability that was exploited before it was known to…

    6 articles · Updated December 4, 2025
  • Five Plead Guilty in North Korean IT Worker Fraud Scheme

    Five individuals have pleaded guilty to facilitating North Korean operatives in obtaining remote IT jobs at U.S. companies by using false and stolen identities. The U.S. Department of Justice has also seized $15 million…

    39 articles · Updated November 17, 2025
  • Enhanced ClayRat Android Spyware Threatens Full Device Control

    A new variant of the ClayRat Android spyware has been identified, capable of full device takeover. Initially discovered in October 2025, this spyware targets Russian users and has expanded its capabilities to include…

    4 articles · Updated December 8, 2025
  • Surge in Android Malware: Albiriox and Sturnus Target User Accounts

    In 2025, Android users are facing a significant increase in malware threats, specifically from strains named Albiriox and Sturnus. These malware types are capable of taking over personal accounts, manipulating banking…

    2 articles · Updated December 30, 2025
  • Lazarus Group Linked to $30M Upbit Hack in South Korea

    South Korean authorities suspect that North Korea's Lazarus Group was behind a hack of Upbit, resulting in losses of approximately $30.4 million. The breach involved unusual activity in Solana tokens and led Upbit to…

    100 articles · Updated November 28, 2025
  • CISA Warns of Spyware Targeting Signal and WhatsApp Accounts

    CISA has issued a warning regarding state-backed and mercenary threat actors using commercial spyware to compromise Signal and WhatsApp accounts. These groups employ phishing, fake QR codes, malicious app impersonation,…

    12 articles · Updated November 25, 2025
  • CISA Warns of Spyware Targeting Signal and WhatsApp Users

    CISA has issued a warning regarding the use of commercial spyware by state-backed and cyber-mercenary groups to compromise Signal and WhatsApp accounts. The agency reports that these actors employ various techniques,…

    17 articles · Updated November 27, 2025

Recent Intelligence Reports

  • How Smartphones Get Hacked: The 2026 Threat Landscape You Need to Understand — Vocal.Media · May 20, 2026
  • 2025 Android Malware Surge: Albiriox and Sturnus Enable Account Takeovers — Webpronews · December 30, 2025
  • ClayRat Android spyware evolves, threatens full device takeover — Scworld · December 8, 2025
  • ClayRat Android Spyware Expands Capabilities — Infosecurity-Magazine · December 8, 2025
  • Android Malware ClayRat Steals SMS Messages, Call Logs and Captures Photos — Cyberpress · December 5, 2025
  • ClayRat Android Malware Steals SMS Messages, Call Logs and Capture Victim Photos — Cybersecuritynews · December 5, 2025
  • Marquis breach affects dozens of banks and credit unions. — Thecyberwire · December 5, 2025
  • Zimperium Identifies New ClayRat Spyware Variant with Expanded Capabilities and ... — Globalsecuritymag.Fr · December 4, 2025

CVSS v3.1 Breakdown