The Glitch SPY Android RAT is distributed via a social engineering campaign using a fraudulent rental platform, delivering a malicious APK dropper that abuses the Android Accessibility Service to gain full device control for surveillance, financial theft, and remote account takeover. The article does not provide a CVSS score, specific affected Android version ranges, a fixed software version, or a workaround. Zimperium reports its Mobile Threat Defense and Runtime Protection products provide out-of-the-box detection for both the dropper and final payload.
blog Jul 01, 2026 Rapid Response: Zimperium Delivers Immediate Coverage for Emerging Glitch SPY RAT Campaign Zimperium An emerging and highly aggressive Android Remote Access Trojan (RAT) called Glitch SPY has been reported by Cyble . Distributed through a sophisticated social engineering campaign, the malware uses a fraudulent Polish housing and apartment rental platform to lure unsuspecting users into downloading a malicious Android APK. The initial application serves as a dropper—identified as the Brokewell Android Loader—which installs the final Glitch SPY payload. Once on the device, the malware relies heavily on the abuse of the Android Accessibility Service to gain absolute control over the victim's operating system. Inside Glitch SPY: Technical Capabilities Glitch SPY is not a standard information stealer; it is a full-scale surveillance and remote-control platform. Analysis of an exposed command-and-control (C&C) administrative panel indicates the presence of a modular architecture featuring an integrated Builder, Cryptor, and Loader system. This allows threat actors to easily customize app names, package IDs, icons, and decoy WebView URLs for rapid redistribution across different regional campaigns. Once a victim activates the requested Accessibility permissions, Glitch SPY establishes a persistent WebSocket connection to its C&C server and unlocks over 70 distinct commands, including: Abuse of Accessibility Services: Automates the granting of system permissions, intercepts multi-factor authentication (MFA) codes, extracts visible on-screen text, and disables security interfaces without user intervention. Live Stream & Remote UI Execution: Supports real-time device screen streaming, arbitrary UI clicks, remote gestures, and a silent remote-browser capability. This allows attackers to perform account takeovers (ATO) directly from the victim's own device and residential IP address, bypassing traditional banking anti-fraud systems. Advanced Financial and Data Theft: Features a built-in crypto-clipper that monitors the system clipboard and dynamically swaps cryptocurrency wallet addresses (supporting Bitcoin, Ethereum/EVM, and TRON formats) with attacker-controlled destinations. It also supports file system encryption/decryption, keylogging, and standard data harvesting (SMS, call logs, contacts, and live location). Zimperium Coverage and Protection Zimperium clients are fully protected against this threat. The detection engine behind Zimperium’s Mobile Threat Defense (MTD) and Mobile Runtime Protection (zDefend) detects both the Brokewell dropper and the Glitch SPY payloads out-of-the-box via our advanced on device dynamic detections, requiring no updates to maintain comprehensive coverage. Zimperium protection works at multiple layers of the attack chain: Malicious App Detection (MTD and zDefend) Sideloaded App Detection (MTD and zDefend) Malicious Traffic Detection (MTD) Accessibility Active (zDefend) Sideloaded App with Accessibility Active (zDefend) Zimperium remains at the forefront of defending mobile ecosystems against complex, multi-faceted threats like Glitch SPY by combining proactive threat hunting, real-time behavioral ML detection, and continuous updates to IOC coverage. MAPS Mobile Security App Security Latest News Jun 30, 2026 Summer Travel Exposes Mobile as the Most Vulnerable Attack Surface in the Enterprise May 07, 2026 Zimperium Arms SOC and Fraud Teams with a Force Multiplier Against Mobile App Threats