A new threat called Android spyware ClayRat is spreading through Telegram channels and phishing links. The Telegram malware campaign tricks users into installing a fake WhatsApp app, along with counterfeit versions of Google Photos, TikTok, and YouTube.

Researchers say Android spyware ClayRat mainly targets users in Russia. The attackers create convincing download pages that make victims sideload the malicious APK instead of using Google Play. This tactic helps the ClayRat Android threat stay hidden from Play Protect.

Once installed, Android spyware ClayRat functions like advanced Android malware 2025, collecting personal data such as SMS messages, call logs, notifications, and device information. It can also activate the camera or take photos silently, sending everything to a remote server.

The fake apps are well-designed, using interfaces that mimic real ones. The spyware disguised as TikTok or YouTube even shows fake Play Store-style screens to gain trust and permissions. That deception allows the malware to access sensitive data without alerting users.

Because these apps come from outside the official Play Store, regular Android security checks often fail. Users are advised to avoid downloading apps from Telegram links or unknown websites, verify developer names, keep Play Protect enabled, and immediately remove suspicious apps.

If you think you installed a fake WhatsApp app or any version of Android spyware ClayRat, back up your data, reset your device, and change all passwords from a clean phone.

The ClayRat Android threat shows that cybercriminals still rely on social engineering and fake app clones to steal data. Stay alert to any Telegram malware campaign or spyware disguised as TikTok, and download only from trusted sources.