ZeroDayRAT: Banking, OTP and Cryptocurrency Risk

OTP Risk and SMS Dependence

One-time codes delivered by SMS remain a widespread authentication and recovery mechanism, and they are the shortest route from a stolen password to a working session. On a device where SMS or notification access has been granted to malicious software, those codes should be considered visible to the operator.

• Replace SMS codes with an authenticator app, and preferably with passkeys or a hardware security key.
• Remove SMS as an account-recovery method wherever the provider allows it.
• Treat any unprompted code as an active attack signal and report it.
• For high-value accounts, keep the authenticator on a separate device from daily browsing.

Banking Credential Exposure

Overlay techniques — presenting a deceptive interface above a legitimate application — are a general and well-documented mobile-malware method rather than a ZeroDayRAT-specific finding. Combined with input capture and screen visibility, they mean credentials entered on a compromised device cannot be assumed private. Secondary reporting names the specific apps advertised as targets: Indian UPI apps including PhonePe and Google Pay, alongside Apple Pay and PayPal. An associated account-census module is advertised as enumerating registrations and emails across Google, WhatsApp, Instagram, Facebook, Telegram, Amazon and Indian services including Flipkart and Paytm — a seller claim, not an independently verified behaviour.

• Enable transaction and login alerts on every financial account.
• Verify unexpected payee or limit changes through a channel other than the phone.
• Do not perform banking on a device you suspect; use a clean device instead.
• Report suspected compromise to the bank promptly — many fraud controls are time-sensitive.

Clipboard Manipulation and Address Verification

Cryptocurrency addresses are long and unmemorable, so users copy and paste them. Software that can read or replace clipboard content can substitute a destination address at the moment of pasting. The transaction then executes exactly as the network intends — to the wrong recipient, irreversibly. The crypto module is advertised as scanning specifically for MetaMask, Trust Wallet, Binance, and Coinbase, logging identifiers and balances in addition to performing clipboard substitution — again a seller claim without a published, independently confirmed loss figure.

Wallet Security

• Never enter or photograph a recovery phrase on a phone; treat any phrase that has touched a suspect device as burned.
• Use a hardware wallet so private keys and the confirmation screen live off the phone.
• Separate custody: a daily-use hot wallet with limited funds, cold storage for the rest.
• Review and revoke token approvals and exchange API keys periodically.
• Use withdrawal whitelists and time delays on exchanges where available.
• Perform large transfers from a dedicated device that does not run messaging or email.

If You Suspect Compromise

Move assets using a separate clean device, rotate exchange credentials and API keys, verify destination addresses out-of-band, and contact banks and exchanges to flag the accounts. Full sequencing is in the crypto/finance playbook on the incident-response page.