Loading threat actor…
Cellik is an Android malware family marketed in underground forums as a commercially available mobile surveillance and credential-theft toolkit. It is positioned as a malware-as-a-service style offering and includes a builder that can package its malicious payload with seemingly legitimate Android applications, facilitating social-engineering-based initial access through trojanized apps. Reported functionality includes real-time screen streaming, keylogging, remote access to device camera and microphone, notification interception, hidden web browsing, credential theft through overlay-based phishing, and destructive data wiping. These capabilities indicate a full-featured Android remote access trojan oriented toward financial fraud and broader device compromise. High-confidence reporting supports Cellik as a criminal malware offering rather than a state-linked intrusion set.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.