‘Cellik’ Android RAT Leverages Google Play Retailer

A distant entry Trojan (RAT)-as-a-service makes use of the Google Play Retailer to construct poisoned variations of Android apps. 

That RAT’s title is “Cellik,” and it was coated this week in analysis revealed by Daniel Kelley, analysis fellow with cellular safety vendor iVerify. Android malware is nothing new, however what makes this RAT stand out is that, along with your customary high-level performance, similar to full system management in opposition to a compromised goal, it is built-in with Google’s Play Retailer in as far as attackers can bundle it with in any other case reliable purposes. 

Cellik is one in all a rising class of “x-as-a-service” risk actor choices. Low-level cybercriminals can now pay for turnkey variations of every little thing together with ransomware, credential stealers, phishing kits, command-and-control (C2) infrastructure, and extra.

Kelley known as Cellik half of a bigger pattern of Android malware, a discipline that has matured to the purpose the place “even low-skilled attackers can now run cellular adware campaigns with minimal effort.”

How the Cellik RAT Works

As soon as the attacker manages to get Cellik onto a sufferer’s Android system, stated attacker is given “full management,” iVerify’s weblog defined. It may well stream the sufferer’s display screen on to the attacker, who can then remotely management the system as if holding it themselves. 

Associated:Why a 17-12 months-Previous Constructed an AI Mannequin to Expose Deepfake Maps

The Cellik operator additionally has entry to a keylogger, all on-screen notifications (together with alert historical past for any app), one-time passcodes, the total system’s file system, and delicate browser information (like cookies and auto-fill credentials). Mainly, something the person would have entry to, a profitable attacker would as nicely. 

“The controller can flick thru all recordsdata on the system, obtain or add recordsdata, delete information, and even entry cloud storage directories linked to the telephone. All file transfers and exfiltration are finished with encryption to keep away from detection,” Kelley wrote. Furthermore, “The attacker can remotely navigate to web sites, click on hyperlinks, and fill out types by way of this hidden browser, all with out the telephone’s proprietor seeing any exercise on their display screen.”

None of those options are too revolutionary in their very own proper, however Cellik turns into significantly harmful with its app injection and Play Retailer features. The previous characteristic permits the attacker to place malicious overlays over different apps on the compromised telephone, similar to pretend login screens that harvest credentials. It additionally contains an injector builder that may be custom-made for various purposes. 

On the Google Play entrance, the RAT-as-a-service contains an computerized .apk builder that may instantly browse the Google Play Retailer, obtain reliable apps, put a Cellik payload wrapper round them, and package deal it up for the attacker to distribute to different potential victims. 

Associated:Flaw in Hacktivist Ransomware Lets Victims Decrypt Personal Recordsdata

“The vendor claims Cellik can bypass Google Play safety features by wrapping its payload in trusted apps, basically disabling Play Shield detection,” Kelley wrote. “Whereas Google Play Shield sometimes flags unknown or malicious apps, Trojans hidden inside widespread app packages may slip previous automated evaluations or device-level scanners.”

Kelley tells Darkish Studying that these malicious apps are sometimes distributed in locations the place customers are prone to sideload them. “As soon as put in, it runs quietly within the background and connects to the attacker’s system. It doesn’t depend on exploits — simply social engineering and person belief.”

Takeaways, and Defending In opposition to Cellik

iVerify’s weblog explains that whereas different RATs provide some related capabilities to patrons, Cellik is notable for its Play Retailer options and the breadth of options for the associated fee, which ranges from $150 for a month to $900 for a lifetime subscription. 

For defenders, though cellular safety merchandise might catch malware like Cellik, the perfect recommendation could also be to remain updated on social engineering techniques and to look at what you obtain.

Associated:React2Shell Exploits Flood the Web as Assaults Proceed

“Stick with official app shops to attenuate publicity to malicious apps. Keep away from sideloading until completely obligatory, and should you should set up APKs manually, confirm hashes and signatures earlier than doing so,” Kelley says. “Having an [endpoint detection and response] resolution additionally helps so it could flag points as a person initiates a obtain and mitigates points early if a malicious app does make its manner by way of.”