Clugin is the Android plugin module downloaded by Type B and Type C variants of the Cumulus malware used by ScarCruft. Cumulus is distributed as a malicious APK disguised as a legitimate application, often through direct contact with selected individuals over messaging services. The plugin contains the principal malicious functionality for those variants and forms part of a mobile ROKRAT-related toolset enhanced with FCM or Pushy messaging.