Glitch SPY is an Android remote access trojan spread through a fake Polish apartment-rental app. If you installed an APK from a rental site such as tutaj-dompl[.]com, treat the phone as compromised: disconnect it from sensitive accounts, remove the sideloaded app, revoke Accessibility and device-admin permissions, run Play Protect, and secure banking, email, crypto, and messaging accounts from a separate clean device.
The important point is not only that a suspicious app was installed. Cyble’s analysis shows that the first app can act as the Brokewell Android Loader, then install the Glitch SPY payload after pushing the user through unknown-source and Accessibility prompts. Once that happens, a normal uninstall may be blocked or incomplete until the high-risk permissions are removed first.
What Glitch SPY Does on Android
Glitch SPY is a full remote-control platform for Android devices, not a simple adware app. Public analysis describes more than 70 supported commands, including screen streaming, screenshots, keylogging, SMS and contact theft, call-log collection, location tracking, camera and microphone access, clipboard monitoring, file operations, shell execution, and a hidden remote browser that can run sessions from the victim’s own phone.
That hidden-browser feature changes the account-risk decision. If an attacker opens a bank, wallet, email, or marketplace session through the infected phone, fraud systems may see the victim’s familiar device and IP address. For that reason, cleanup should include account-session review and password changes, not just removing the APK.
How the Fake Rental-App Infection Works
The campaign has been tied to a fake apartment and house-rental site aimed at Polish-speaking users. The page presents a plausible rental workflow and encourages visitors to install a mobile app for viewing reservations, availability checks, saved listings, or confirmation updates. The download is a malicious APK rather than a legitimate store app.
| What the user sees | A rental app, fake update screen, and permission prompts that look necessary to finish setup. |
| What actually happens | The loader asks for unknown-source installation, installs the RAT payload, then pressures the user to enable Accessibility access. |
| Why Accessibility matters | Accessibility can let malware read screen content, tap buttons, grant permissions, interfere with uninstall attempts, and operate apps in the background. |
| Highest-risk follow-up | Banking, crypto, email, messaging, and two-factor authentication flows may be exposed if the phone was used after infection. |
Immediate Steps if You Installed the APK
- Stop using the phone for sensitive logins. Do not open banking, wallet, email, password-manager, or work apps on the suspected device until cleanup is complete.
- Put the phone offline if possible. Enable airplane mode, then turn Wi-Fi off. If you need internet for Play Protect or updates, use it briefly and avoid signing in to sensitive accounts.
- Use a separate clean device for account recovery. Change passwords and review sessions from another phone or computer, not from the suspected Android device.
- Preserve evidence if money or accounts were stolen. Take photos of the fake site, app name, SMS messages, suspicious transactions, and warnings before deleting everything.
Remove Glitch SPY and the Loader
Once the phone is contained, use Trojan Scanner for Android to check the installed apps and supported downloads. The visible rental app and the later payload may be separate installations; clear app-by-app findings give you more to work with than a familiar name or a missing icon.
- Open Trojan Scanner, update the threat database, and tap Start. Let the check finish before reviewing its findings.
- Review the detected apps and files. Open the details, compare the app with the installation that started the problem, and read the reason for the warning. Anti Spy can help highlight suspicious combinations of sensitive access in hidden apps.
- Remove unwanted items and confirm Android’s prompts. After cleanup, restart normally and scan again. Confirm that the suspicious app stays absent and its access does not return.
If an app blocks removal
Android menus differ by vendor. If the suspicious app closes Settings, disables Uninstall, or keeps controlling the screen, recover that access before trying removal again:
- Use your device maker’s Safe Mode instructions. Safe Mode prevents most third-party apps from running so that you can reach their settings.
- Disable the suspicious Accessibility service. Open Settings, search for Accessibility, and turn off the service connected to the rental app, updater, loader, or recently sideloaded APK. Keep legitimate assistive tools enabled.
- Remove its Device Admin access. Search Settings for Device admin apps or Device administrators, and deactivate the unwanted entry.
- Uninstall the suspicious app and any helper app. Check Settings → Apps for unfamiliar rental, update, viewer, cleaner, security, or blank-icon apps installed around the same time. Removing only the first app may leave the later component installed.
- Revoke install-from-unknown-apps permission. Turn off this permission for the browser, file manager, messenger, or downloader used to install the APK.
- Restart normally and check again with Trojan Scanner. Review any remaining findings and confirm removal of unwanted items. Keep Play Protect enabled, run its check, and install Android and Google Play system updates before returning to sensitive apps.
If you retained the APK, use Menu → Check a file → Choose file in Trojan Scanner to examine it without installing it. Leave a flagged APK uninstalled and delete the unwanted download. You can also check the saved lure address with the Gridinsoft URL scanner. Our Android malware removal guide shows the scan and file-check controls.
If Accessibility or Device Admin permissions re-enable themselves, the app immediately returns after uninstall, or sensitive accounts were accessed while the APK was active, do not assume a normal uninstall is enough. Back up only photos, documents, and contacts you trust, then perform a factory reset. Avoid restoring a full app backup that may reinstall the same malicious or sideloaded package.
Account Recovery After Glitch SPY Exposure
Because this RAT can capture screens, SMS messages, keystrokes, clipboard content, and browser sessions, account recovery should happen from a clean device.
- Email: change the password, remove unknown forwarding rules, review recovery email/phone settings, and sign out all sessions.
- Banking and payment apps: call the bank if the phone was infected while banking apps or card wallets were used. Ask about recent device sessions, pending transfers, and card controls.
- Crypto wallets: assume copied wallet addresses may have been replaced. Review outgoing transactions and move funds to a fresh wallet from a clean device if seed phrases or wallet apps were exposed.
- Messaging accounts: check linked devices in WhatsApp, Telegram, Signal, and similar apps. Remove sessions you do not recognize.
- Two-factor authentication: regenerate backup codes and move authenticator apps only after the phone is clean or reset.
Signs the Phone May Still Be Compromised
Glitch SPY-style infections can be quiet. Look for several signals together rather than one vague symptom:
- unknown apps, blank icons, or apps with generic names such as Update, Service, Viewer, Security, or Cleaner;
- Accessibility, notification access, VPN, SMS, camera, microphone, or install-unknown-apps permission granted to an app you do not trust;
- verification codes or banking prompts appearing when you did not start a login;
- clipboard changes when copying crypto wallet addresses;
- mobile data or battery spikes while the phone is idle;
- camera, microphone, or screen-recording indicators at unexpected times;
- apps closing, security settings changing, or uninstall screens disappearing while you interact with the phone.
For a broader triage checklist, see our guide on how to tell if your phone is hacked. For another Android banker example that abuses Accessibility and remote-control flows, compare the TrickMo.C Android banker case.
How to Avoid the Next Fake APK Lure
- Install rental, banking, delivery, and marketplace apps only from Google Play or the official site listed by the real company.
- Do not enable install unknown apps for a browser or messenger just because a site says an app is required.
- Treat Accessibility requests from shopping, rental, update, cleaner, and viewer apps as high risk unless the app has a clear accessibility purpose.
- Keep Play Protect enabled and allow scans of unknown apps when Android offers that option.
- Before installing an APK, check the download with Trojan Scanner’s Check a file control. Avoid the installation entirely if its source is a one-off domain, shortened link, or urgent chat message.
FAQ
Is Glitch SPY the same as Brokewell?
No. In the reported campaign, the first malicious app acts as the Brokewell Android Loader, while Glitch SPY is the payload installed afterward. For the victim, both parts matter because the loader may be the visible app while the RAT runs behind it.
Can I remove Glitch SPY without a factory reset?
Sometimes, yes, if you can disable Accessibility and Device Admin access, uninstall the sideloaded app and payload, scan with Play Protect, and no symptoms return. Use a factory reset when permissions cannot be revoked, the app returns, account theft occurred, or you cannot trust the device state.
Does Play Protect catch every sideloaded Android RAT?
No security layer catches every new APK immediately. Keep Play Protect enabled, but also avoid unknown-source installs, review high-risk permissions, and treat fake update or rental-app prompts as suspicious.
Should I change passwords from the infected phone?
No. Change passwords, revoke sessions, and move authenticator accounts from a clean device. A RAT that can capture screen content or remote-control the phone may observe password changes made on the infected device.
Can Gridinsoft scan the Android phone itself?
Yes. Trojan Scanner is Gridinsoft’s Android app for checking installed apps and supported downloads. Review its findings, choose removal for unwanted items, and confirm Android’s uninstall prompt. If a malicious app blocks removal, use the permission and Safe Mode recovery steps above. Secure exposed accounts from a separate trusted device.
References
- Cyble Research and Intelligence Labs. “Glitch SPY: An Emerging Android RAT Distributed Through a Fake Polish Rental App.” Cyble, June 30, 2026. https://cyble.com/blog/glitch-spy-rat-distributed-via-fake-polish-app/
- Zimperium. “Rapid Response: Zimperium Delivers Immediate Coverage for Emerging Glitch SPY RAT Campaign.” Zimperium Blog, July 1, 2026. https://zimperium.com/blog/rapid-response-zimperium-delivers-immediate-coverage-for-emerging-glitch-spy-rat-campaign
- Google. “Use Google Play Protect to help keep your apps safe & your data private.” Google Play Help, accessed July 2, 2026. https://support.google.com/googleplay/answer/2812853?hl=en
