Cellik: The virus hiding in the official apps on your phone

Usually, the golden rule of security is simple: "Don't download apps from shady websites; only use the Official Store." But what do you do when the danger comes from right there? In 2026, hackers found a way to bypass even the filters of tech giants.

The name of the threat is Cellik. It’s a type of virus (Trojan) that disguises itself as harmless apps, such as a flashlight, a calculator, or a document scanner, available directly in the Google Play Store. At Altanet Craiova, we analyze these “invisible” threats so you know what to watch out for before you hit the “Install” button.

What is Cellik and why is it different?

Most viruses are blocked by your phone’s security systems because they try to communicate with suspicious hacker servers. Cellik is smarter. It uses a tactic called “hiding in plain sight.”

Instead of using a secret server, this virus uses legitimate platforms, such as Google Drive or Google Play, to receive commands from attackers. Since your phone trusts Google, it doesn’t block this communication. Basically, the hacker controls your phone using the same channels you use for photos or documents.

What can it do to your phone?

Cellik is a RAT (Remote Access Trojan). This means that, once installed, it turns your phone into a spying tool that:

• Takes full control: It can open apps, read messages, and access files without your knowledge.
• Records everything: It can activate the microphone or camera and take screenshots.
• Is hard to remove: Since it looks like a system app or a useful one, many users don’t suspect a thing.

How do you spot a trap app?

Even if the virus tricks automated systems, it can’t trick you if you pay attention to the details. Here are the three telltale signs:

• Illogical permissions: This is the biggest mistake hackers make. If you install a “Flashlight” app and it asks for access to “Contacts,” “Location,” and “Microphone,” deny it immediately. A flashlight only needs the camera (for the flash), nothing else.
• Number of downloads vs. reviews: Be skeptical if an app has thousands of downloads but no written reviews, or if it only has 5-star reviews that sound robotic (“Very good app,” “Super cool”).
• Battery behavior: As with other viruses, Cellik consumes resources to communicate with hackers. If your phone drains quickly after installing a new app, uninstall it.

To stay up to date on new types of malware targeting Android, check out BleepingComputer’s news section on Android security.

Conclusion

The official store is safer than pirated sites, but it’s not perfect. The ultimate responsibility lies with you. Always check what “permissions” you’re granting to a new app.

If your phone is acting strangely or you want to implement mobile security solutions for your employees, we can help. Our team offers comprehensive IT services. Visit our contact page and protect your data.

---

This material is part of Altanet’s educational series on digital security. Want to know what other risks you’re facing this year? See the complete list of cyber threats for 2026.