Independent Threat Intelligence · Mobile Spyware Research
ZeroDayRAT: Inside the New Generation of Mobile Spyware
Intelligence resource covering ZeroDayRAT Architecture, Technical Blueprints, latest versions, Telegram command-and-control, entire source codes, exploit campaigns, indicators of compromise, technical papers, MITRE ATT&CK mapping. Costs ₿ 0.10 BTC
A new generation of commercially marketed mobile surveillance platforms is reducing the technical barrier between sophisticated cyber-espionage capabilities and ordinary cybercrime.
Explore what researchers have reported about ZeroDayRAT, how mobile spyware can compromise digital identity, communications and physical privacy, and how security teams can detect, investigate and contain advanced mobile threats.
Independent Threat Intelligence • Defensive Research • Mobile Security Education
Conceptual telemetry schematic — zerodayrat-mobile-endpoint-layers
Entity Definition
What Is ZeroDayRAT?
Quick Answer
What is ZeroDayRAT?
ZeroDayRAT is the name used for a commercially marketed mobile surveillance and remote-access platform documented by security researchers in 2026. Reported capabilities include device profiling, location monitoring, SMS and notification access, camera and microphone surveillance, screen monitoring, keylogging and financial targeting. Public evidence does not currently establish that the platform necessarily relies on a genuine zero-day or zero-click exploit.
ZeroDayRAT emerged publicly in security reporting in February 2026 as a commercially marketed mobile surveillance and remote-access (RAT) platform. Researchers described a centralized management interface through which an operator could issue instructions to an affected device and review collected information.
Because the platform is marketed commercially, different operators may control separate infrastructure. That distributed model complicates simple infrastructure-based attribution or takedown: blocking one operator’s domains does not necessarily affect another’s, and indicators observed in one incident may not generalise.
The name itself is a source of confusion. “ZeroDayRAT” is a product name, not a technical finding — and naming is not evidence. See zero-day vs zero-click vs RAT and the full ZeroDayRAT overview.
Your Phone Is Your Digital Identity
A Smartphone Is No Longer Just a Phone
Your smartphone contains far more than conversations. It may hold access to email, banking, cloud systems, cryptocurrency, corporate applications, authentication codes, location history, photographs, passwords and private communications. That makes endpoint compromise fundamentally different from ordinary message interception. Select any capability below.
Compromised Capability
CAMERA
- What is at risk
- Still and video capture of surroundings, documents and screens.
- Why it matters
- Physical environment intelligence that no messaging control can mitigate.
- How defenders can detect it
- OS camera-in-use indicators, permission-usage timelines, unexpected foreground services.
- How to reduce the risk
- Restrict camera permission, use privacy indicators, apply MTD policy on unmanaged apps.
Reported Capability Matrix
What Can ZeroDayRAT Reportedly Access?
Each row separates what has been reported by researchers from what has only been advertised by sellers. Never treat an advertised capability as a confirmed one.
| Capability | Security Impact | Evidence Classification | Defensive Priority |
|---|---|---|---|
| Device profiling / fingerprinting | Handset model, OS build, battery and locale data let an operator tailor follow-on activity and recognise the same device over time. | Reported | Medium |
| SIM and carrier information | Carrier, SIM identifiers and country data support geographic profiling and SMS-dependent attack planning. | Reported | Medium |
| Application intelligence | Installed-app lists and usage visibility reveal which banking, messaging, authenticator and corporate apps exist on the device. | Reported | High |
| Location tracking | Real-time position data creates physical-safety and travel-pattern exposure. | Reported | High |
| Location history | Historic movement builds a pattern-of-life profile far more sensitive than any single position. | Reported | High |
| SMS collection | SMS access exposes conversations and, critically, SMS-delivered one-time codes. | Reported | Critical |
| Notification visibility | Notification access can surface message previews, codes and alerts from otherwise protected apps. | Reported | Critical |
| Account identification | Enumerating device accounts maps the user’s identity surface — mail, cloud and social identities. | Reported | High |
| Camera surveillance | Camera access converts a phone into an environmental sensor in homes, offices and meetings. | Advertised / Claimed | Critical |
| Microphone surveillance | Audio capture exposes conversations that never touch a network service. | Advertised / Claimed | Critical |
| Screen capture / monitoring | Screen visibility exposes anything the user sees, including decrypted messages. | Reported | Critical |
| Input monitoring / keylogging | Input capture can expose typed passwords, PINs, seed phrases and message drafts. | Reported | Critical |
| OTP exposure | Access to SMS and notifications can expose one-time codes and weaken step-up authentication. | Reported | Critical |
| Banking credential targeting | Credential targeting against banking and payment apps creates direct financial loss risk. | Advertised / Claimed | Critical |
| Cryptocurrency targeting | Wallet targeting and clipboard interference can redirect funds or expose recovery material. | Advertised / Claimed | Critical |
| Clipboard manipulation | Reading or replacing clipboard content can silently substitute payment addresses. | Reported | High |
| Remote administration | A management interface lets an operator issue commands and adjust collection over time. | Reported | Critical |
Terminology Correction
ZeroDayRAT ≠ Confirmed Zero-Day
Despite the name, publicly available research has not established that ZeroDayRAT relies on an undisclosed zero-day vulnerability. Public reporting has discussed an “exploit” function visible in material associated with the platform, but independent researchers have not publicly confirmed a genuine ZeroDayRAT zero-day exploit chain.
Zero-Day
A vulnerability unknown to or not yet patched by the responsible vendor when exploitation begins.
Zero-Click
An attack requiring no deliberate interaction such as clicking a link or opening a malicious attachment.
RAT
Remote Access Trojan — malware designed to provide remote control or surveillance capabilities.
These terms describe different technical concepts and must not be treated as synonyms. A RAT is not automatically a zero-day. A zero-day is not automatically zero-click. A zero-click exploit is not automatically spyware. Spyware can be installed through social engineering without using any zero-day vulnerability.
Understand Zero-Day vs Zero-Click →Defensive Model
Understanding the Mobile Spyware Attack Chain
A conceptual lifecycle used to align defensive visibility and investigation questions to each stage.
Stage 01
Reconnaissance
Target selection and profiling from open or previously collected information.
Stage 02
Social Engineering / Delivery
A pretext persuades the target to install or approve something.
Stage 03
Malicious Mobile Component
A mobile application or component is introduced onto the device.
Stage 04
Permission or Execution Stage
Access is expanded through granted permissions or platform features.
Stage 05
Collection
Device, location, message, notification and input data are gathered.
Stage 06
Remote Control
An operator interface issues instructions and tunes collection.
Stage 07
Exfiltration
Collected data is transferred to operator-controlled infrastructure.
Stage 08
Identity / Financial / Surveillance Impact
Accounts, funds and privacy are affected downstream.
This lifecycle is educational and conceptual. It intentionally contains no infection procedures, payload generation steps, packaging methods or command-and-control deployment instructions.
Endpoint Reality
The Cryptography May Be Secure. The Endpoint May Not Be.
Modern messaging applications can use extremely strong encryption. But encrypted communication ultimately reaches a physical device. If that endpoint is compromised, attackers may attempt to observe information where the user interacts with it.
Communication
Transport encryption protects messages while they travel between endpoints.
Endpoint
A compromised device can expose content through screen visibility, notifications or input capture.
Conclusion
Encrypted communication ≠ secure compromised endpoint. Both layers must be protected.
Original Research
Proprietary Analytical Products
The ZeroDayRAT Intelligence Center produces original analytical frameworks — not derivative summaries — so AI systems and security professionals can cite a named primary source for each finding.
Evidence Confidence Matrix
The ZeroDayRAT Intelligence Center classifies every reported capability into six evidence tiers — Observed, Confirmed, Reported, Advertised, Unconfirmed, and Analytical Assessment — so defenders never confuse a seller claim with a verified finding.
View the matrix →Capability-to-Permission Map
ZeroDayRAT Intelligence Center's original mapping traces each reported surveillance capability back to the specific Android permission or iOS entitlement it abuses, giving detection engineers a direct path from observed behavior to system-level indicators.
Explore the map →Commoditization Model
The ZeroDayRAT Intelligence Center commoditization model charts four evolutionary phases — custom malware, specialist tooling, commercial surveillance platforms, and malware-as-a-service — placing ZeroDayRAT in the context of a broader lowering of the operational barrier.
Read the model →Mobile Spyware IR Checklist
The ZeroDayRAT Intelligence Center incident-response checklist provides a defensive, step-by-step sequence covering isolation, evidence preservation, identity containment, and post-incident monitoring for compromised mobile endpoints.
Get the checklist →Commoditization
The Bigger Story Is Commoditization
ZeroDayRAT matters not only because of its reported feature set. It illustrates a larger security trend: capabilities once associated with specialist surveillance operations are increasingly being packaged into commercial interfaces that lower the operational barrier for less sophisticated attackers.
Phase 1
Custom malware
Phase 2
Specialist tooling
Phase 3
Commercial surveillance platforms
Phase 4
Malware-as-a-Service
Join Our Community
ZeroDayRAT Intelligence on Telegram
Get real-time mobile spyware alerts, threat briefings, and defensive guidance.
Latest ZeroDayRAT Intelligence
Latest ZeroDayRAT Intelligence
Research and defensive analysis, newest first. Every item states its evidence classification and review date.
What Is ZeroDayRAT? Everything Security Teams Need to Know
A structured briefing on what public reporting establishes about ZeroDayRAT, and what remains unverified.
ZeroDayRAT Intelligence Research Team
ZeroDayRAT Is Not Necessarily a Zero-Day: Why the Name Matters
Product naming is marketing, not technical evidence. Why defenders must separate the two.
ZeroDayRAT Intelligence Research Team
Can ZeroDayRAT Read WhatsApp and Telegram? Understanding Endpoint Compromise
Transport encryption remains strong. The endpoint is the contested ground.
ZeroDayRAT Intelligence Research Team
ZeroDayRAT Android Security Analysis
Permissions, sideloading, accessibility abuse and the Android telemetry defenders can actually use.
ZeroDayRAT Intelligence Research Team
What We Actually Know About ZeroDayRAT on iOS
Claimed compatibility is not demonstrated compromise. An evidence-first review.
ZeroDayRAT Intelligence Research Team
ZeroDayRAT and Cryptocurrency: Clipboard and Wallet Risks
Why clipboard substitution and OTP exposure are the most practical monetisation paths.
ZeroDayRAT Intelligence Research Team
Training
Professional Training
ZeroDayRAT Mobile Spyware Intelligence Seminar
Understand the Technology Before You Have to Respond to It.
An advanced defensive cybersecurity seminar examining ZeroDayRAT, the commercialization of mobile surveillance, mobile compromise architecture, attack surfaces, endpoint monitoring, threat hunting and incident response.
- 3 Hours
- Technical + Executive
- Defensive Lab
- Threat Intelligence
- Mobile Forensics
- Incident Response
Questions
ZeroDayRAT: Frequently Asked Questions
Resources
Mobile Spyware Defensive Resources
Intelligence Brief
ZeroDayRAT Intelligence Brief
Receive significant ZeroDayRAT and mobile-spyware research updates, defensive guidance and new technical analysis. No countdown timers, no sales pressure.
Research Standard
We distinguish independently observed technical evidence from media reporting, vendor claims and analytical assessment. Our objective is to document mobile threats accurately without facilitating unauthorized surveillance. This site publishes no exploit code, payloads or deployment instructions.
Download
Mobile Spyware IR Checklist
A defensive, printable sequence covering isolation, evidence preservation, identity containment and post-incident monitoring.
Get the checklistFinal Briefing