Cellik Android Malware: The New Frontier for Trojanized Google Play Apps

In December 2025, cybersecurity researchers identified a new Android malware-as-a-service (MaaS) dubbed Cellik that enables cybercriminals to create malicious variants of popular Google Play Store apps. Distributed via underground forums, Cellik’s service allows threat actors to select legitimate apps, inject sophisticated malware, and maintain original app functionality, thereby bypassing typical user suspicion and potentially evading Google Play Protect. Cellik's features include real-time screen streaming, notification interception, filesystem browsing, data exfiltration, device wiping, and encrypted command-and-control communications. Attackers can also overlay fake login screens, inject malicious payloads into trusted apps, and exploit a hidden browser to steal credentials using stored cookies from infected devices.

The emergence of Cellik signals an evolution in Android threat tooling, where MaaS kits empower less skilled actors to launch advanced attacks. This development heightens risks for organizations subject to mobile threats as attackers embrace more modular and evasive tactics, underlining the urgent need for advanced mobile security controls and proactive user education.

Cellik demonstrates how attackers can exploit trust in official app stores by deploying sophisticated malware hidden within legitimate app interfaces. Its malware-as-a-service offering lowers the barrier to entry for cybercriminals and reflects a growing trend in modular, rapidly-adaptable threats targeting mobile ecosystems—making vigilant security and timely detection more urgent than ever.