A new version of the ClayRat spyware has begun to spread in fraudulent Telegram channels. It is disguised as WhatsApp, Google Photos, TikTok, and YouTube applications. This was reported by the Department for Organizing the Fight against Illegal Use of Information and Communication Technologies (UBK) of the Ministry of Internal Affairs of Russia.
After installation and activation on a smartphone, the malware gains access to SMS, call logs, notifications, and system data. ClayRat automatically sends links to download spyware to all contacts from the victim's address book. Thus, each infected phone continues to spread the virus.
The UBK of the Ministry of Internal Affairs of Russia advised users to download applications only from trusted sources. These include RuStore, a store created with the support of the Ministry of Digital Development of the Russian Federation.
Each program published on the digital platform undergoes a security check. In foreign stores Galaxy Store, Huawei AppGallery, F-Droid, content is controlled in a similar way.