Cellik Android Malware Creates Malicious Versions of Google Play Apps

Cellik is a malware-as-a-service (MaaS) that enables cybercriminals to embed malicious code into legitimate apps available on the Google Play Store. Discovered by the mobile security firm iVerify, Cellik allows attackers to create trojanized versions of trusted applications, maintaining their original interface and functionality.

This malware can capture and stream a victim’s screen in real time, intercept notifications, and exfiltrate files. It also includes a hidden browser mode that allows attackers to access websites using the victim’s stored cookies. The malware’s app injection system can overlay fake login screens or inject malicious code into any app, complicating detection.

The seller claims that Cellik can bypass Google Play security features by wrapping its payload in trusted apps, potentially evading Play Protect detection. Although Google has been contacted for confirmation, no response has been received yet.

The implications of Cellik’s capabilities are significant for Android users and organizations. Users must be vigilant about the apps they download and the permissions they grant, as trusted apps could become compromised.

This situation highlights the ongoing risks associated with malware that can exploit legitimate platforms. Users should be aware of the potential for trusted applications to turn rogue and take proactive measures to safeguard their devices.

Organizations should educate their employees about the risks of sideloading APKs and ensure that Play Protect is active on all devices. Regular monitoring for unusual activity can help identify potential infections early.