An emerging Android RAT family called Glitch SPY, delivered through a fraudulent Polish apartment-rental site that tricks victims into installing an APK.
The downloader identified as the Brokewell Android Loader shows a rental-themed interface as a decoy while installing the Glitch SPY payload after convincing users to permit installs from unknown sources.
Once installed, Glitch SPY immediately requests Android Accessibility Service access and abuses it extensively.
With Accessibility enabled, the malware automates permission grants, inspects visible UI text, performs taps and swipes, simulates remote input, and interacts with app screens without further user involvement.
That single user action (enabling Accessibility) unlocks most of the RAT’s capabilities and keeps the implant operating stealthily in the background.
Glitch SPY Expands Tactics
Communication with the attacker’s infrastructure runs over a persistent WebSocket channel to a command-and-control (C&C) server. In the observed sample, C&C domains and an exposed admin panel branded “Glitch SPY” revealed a modular control interface.
The platform includes Agents (infected devices), Viewer (live control), Builder (payload generation), Dropper, Cryptor (coming soon), and stored Payloads indicating an operator-friendly builder platform meant for repeat campaigns and retargeting.
Glitch SPY supports more than 70 commands.
Key surveillance and control features include live screen streaming, screenshots, screen-reader text extraction, SMS and call-log exfiltration, contact and account harvesting, location tracking, camera and microphone capture, offline and live keylogging, file management and exfiltration, shell execution, and device-lock/unlock actions.
The implant can also hide its icon, block uninstall attempts, and suppress biometric prompts to force PIN fallback.
Two capabilities make Glitch SPY particularly dangerous for financial and account fraud: a crypto-clipper and a hidden remote browser. The crypto-clipper monitors clipboard content and replaces copied cryptocurrency addresses with attacker-controlled addresses.
It recognizes multiple formats ETH/EVM (0x), TRON (T), Bitcoin legacy (1/3), and Bech32 (bc1q/bc1p) and handles URI-style prefixes (bitcoin:, ethereum:, erc20:, and others).
When enabled, the clipper updates the clipboard via Android’s ClipboardManager so victims paste an attacker address instead of the intended wallet, silently redirecting crypto transfers.
MITRE ATT&CK
| Tactic | Technique ID | Procedure |
| Initial Access | Phishing | Glitch SPY is distributed via phishing sites |
| Persistence | Event Triggered Execution: Broadcast Receivers (T1624.001) | Glitch SPY implemented a broadcast receiver for screen capturing |
According to Cyble research, the remote browser runs inside a hidden off-screen WebView on the victim’s device.
Operators can load URLs, switch rendering modes (mobile/desktop), click elements, enter text, run JavaScript-style form fills, and send keyboard actions all while activity originates from the victim’s IP and uses their cookies and sessions.
Combined with live screen streaming, keylogging, clipboard monitoring, and Accessibility-driven input, this lets attackers perform web-based account takeover and transaction manipulations that are less likely to trigger fraud detection tied to IP or device fingerprints.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
