ClayRat Spyware Collapses Months After Launch as Developer Arrested in Russia

A $300-a-month spyware tool promised total device control—until its own sloppy code brought it crashing down. Now, one suspect faces justice.

, and Administrator

2026 May 4 . 5:02 AM

1 min read

The image shows a screenshot of a computer screen with a group of people on it. On the left side of... — The image shows a screenshot of a computer screen with a group of people on it. On the left side of the screen, there is a popup with text and icons, and on the right side, there are pictures of the people. The text reads "Kaspersky Internet Security" and the icons appear to be related to the security features of the software.

ClayRat Spyware Collapses Months After Launch as Developer Arrested in Russia

A powerful Android spyware called ClayRat has shut down just months after its launch. The malware, designed for espionage and remote device control, saw its entire infrastructure collapse by December 2025. Authorities have since arrested a suspected developer in Krasnodar, Russia. ClayRat first appeared in mid-2025, marketed through Telegram channels under a subscription model. Customers paid $90 per week or $300 per month, or handed over 15% of any profits made using the tool. At its height, the malware had over 600 samples and around 50 droppers to spread infections.

The spyware could intercept SMS messages, steal contacts, take photos, record screens, and execute remote commands. It spread mainly via phishing sites and fake apps disguised as legitimate services, with most victims based in Russia. Security flaws quickly unravelled the operation. Developers used plaintext passwords, weak code obfuscation, and predictable distribution tactics. These mistakes mirrored the downfall of other short-lived malware, like the banking trojan Gorilla, which also collapsed due to poor security practices. By late 2025, all known ClayRat command servers had gone offline, ending its run. Russian police later detained a suspect linked to the malware’s creation in Krasnodar.

ClayRat’s rapid shutdown highlights the risks of sloppy cybercrime operations. The malware’s brief but active period infected hundreds before technical errors forced its closure. Authorities continue to investigate its remaining connections and impact.