Loading malware…
Cellik is an Android remote access trojan offered as a malware-as-a-service platform and designed to turn trojanized legitimate applications into covert surveillance and fraud-enablement tools. It is notable for a built-in APK builder with Google Play app integration that allows operators to wrap its payload inside trusted Android applications while preserving the original app’s appearance and functionality, lowering the barrier to entry for criminal operators and improving social-engineering effectiveness.
Once installed on an Android device, Cellik provides extensive remote-control and surveillance capabilities. Reported functions include real-time screen streaming, remote interaction with the device interface, keylogging, interception of notifications including authentication messages, access to the camera and microphone, file browsing and transfer, and device data wiping. Cellik also includes a hidden browser module that can operate invisibly on the device, enabling attackers to abuse stored session material such as cookies or autofill data, capture submitted form data, and conduct covert browsing or phishing activity from the victim’s device context. An injection framework supports overlay attacks and custom app-targeted credential theft by presenting fake login screens over legitimate applications.
Cellik has been marketed on underground forums at relatively low subscription prices, reflecting its positioning as a commercially available Android RAT rather than a bespoke intrusion tool. Its feature set overlaps with advanced mobile spyware and banking-fraud tooling, including credential harvesting, surveillance, and theft of sensitive data from other applications. Reporting also attributes cryptocurrency-wallet theft and location tracking capabilities to the platform. Cellik targets Android devices and is associated with sideloaded trojanized APK distribution rather than official app-store delivery. It has been highlighted as part of a broader wave of increasingly professionalized Android malware families that combine user-friendly operator tooling with strong surveillance and account-compromise functionality.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Related coverage The Silent Hijacker: New Cellik Android RAT Turns Legitimate Google Play Apps into Surveillance Tools
Named as one of 17 Android malware families detected in the wild over four months.
Tags:Android apk Cellik Kimwolf malware
Cellik is a newly identified Android Remote Access Trojan (RAT) that covertly transforms legitimate Google Play apps into surveillance tools, enabling attackers to monitor and control infected devices.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.