Before You Remove Anything
If you suspect your device is infected with ZeroDayRAT, the instinct is to factory reset immediately. Do not do that yet. A factory reset destroys evidence that could help identify the spyware, protect other potential victims, and support a formal investigation. The first steps are isolation and evidence preservation, not removal. This guide from the ZeroDayRAT Intelligence Center walks through the full process in the right order.
For the complete incident response playbook, see our incident response guide. This article focuses on the practical removal steps for individuals.
Step 1: Isolate the Device
Stop the Bleeding
The first thing to do is stop the spyware from communicating. Put the device in airplane mode. This cuts the network connection, which stops the implant from beaconing to the C2 and stops any active data exfiltration. If you need to keep the device on for evidence reasons, airplane mode is the right balance.
Move to a Clean Device
If you need to make calls, send messages, or access accounts, do it from a different device that you know is clean. Do not use the suspected device for anything sensitive while it is in its current state. This includes banking, email, messaging apps, and any account that uses OTP verification.
Do Not Delete Anything Yet
Do not uninstall the suspicious app, revoke permissions, or delete files yet. These actions can destroy evidence and may trigger the spyware to take defensive action, like hiding deeper or wiping its own artifacts. Preserve first, remove second.
Step 2: Preserve Evidence
Document What You See
Take screenshots of everything suspicious. This includes the app list, the accessibility settings, the permission list for any suspicious app, the notification access settings, the device admin settings, and any unusual files or directories. Use a separate clean device to take photos of the screen if you want to avoid saving screenshots on the compromised device.
Note the Timeline
Write down when you first noticed something unusual, what the unusual behavior was, and what apps you installed around that time. This timeline helps identify the infection vector and may be useful if you report the incident to law enforcement or a security team.
Capture Network Information
If you have access to the device's network settings, note any unusual VPN configurations, proxy settings, or certificates. On Android, check Settings > Network > VPN and Settings > Security > Encryption and credentials. On iOS, check Settings > General > VPN and Device Management. These are common places for spyware to establish persistence.
Consider Professional Help
If you are a high-risk individual, a journalist, an activist, or an executive, consider contacting a professional incident responder or a digital security helpline before doing anything else. Organizations like Access Now, Citizen Lab, and Amnesty Tech help people in high-risk situations. The ZeroDayRAT Intelligence Center also accepts intelligence tips through our contact page.
Step 3: Identify the Malicious App (Android)
Check Accessibility Settings
On Android, go to Settings > Accessibility and look at the list of apps with accessibility access. Any app you do not recognize is a candidate. Legitimate accessibility apps are rare and usually obvious, screen readers, switch access, and known manufacturer tools. Anything else is suspicious.
Check Notification Access
Go to Settings > Apps > Special access > Notification access. Look for apps you do not recognize. Spyware uses notification access to intercept OTP codes and messaging app notifications. Any unknown app here is suspicious.
Check Device Admin Apps
Go to Settings > Security > Device admin apps. Device admin privileges make an app harder to uninstall. If an unknown app has device admin access, it may be spyware. You will need to revoke device admin access before you can uninstall the app.
Check Installed Apps
Go through the full app list. Look for apps you did not install, apps with generic names, apps disguised as system tools or utilities, and apps with no icon or a hidden icon. The spyware may have hidden its icon, so it may not appear in the app drawer, but it should appear in the settings app list.
Check App Permissions
For any suspicious app, check its permissions. The dangerous combination is accessibility plus SMS plus notifications plus location plus camera plus microphone. If an app has this combination, it is spyware until proven otherwise. For the full permission analysis, see our capabilities page.
Step 4: Remove the Malicious App (Android)
Revoke Device Admin Access First
If the app has device admin access, revoke it before trying to uninstall. Go to Settings > Security > Device admin apps, select the suspicious app, and deactivate it. Without this step, the uninstall button may be grayed out.
Revoke All Permissions
Go to the app's permission settings and revoke every permission. This stops the spyware from collecting data even if the uninstall fails for some reason. Revoke accessibility, SMS, notifications, location, camera, microphone, and any other permissions.
Uninstall the App
Go to Settings > Apps, select the suspicious app, and uninstall it. If the uninstall button is still grayed out, the app may have additional protections. In that case, you may need to boot into safe mode and uninstall from there, or proceed to a factory reset.
Remove Configuration Profiles
If you found any configuration profiles or VPN profiles in step 2, remove them. Go to Settings > Security or Settings > Network and remove any profiles you did not install intentionally.
Step 5: Identify and Remove (iOS)
Check Configuration Profiles
On iOS, go to Settings > General > VPN and Device Management. Look for configuration profiles you did not install. If you find one, remove it. This is the most common iOS persistence mechanism for commercial spyware.
Check MDM Enrollment
In the same settings area, check for MDM enrollment. If your device is enrolled in an MDM you did not authorize, you need to unenroll. The process depends on the MDM, but typically involves going to Settings > General > Device Management and removing the management profile.
Check Enterprise Apps
Look for apps signed with enterprise certificates from organizations you do not recognize. These are apps installed outside the App Store using enterprise distribution. If you find one, delete it. Go to Settings > General > Device Management, select the enterprise certificate, and remove it, then delete the app.
Check Custom Keyboards
Go to Settings > General > Keyboard > Keyboards. If a custom keyboard you did not install is listed, remove it. Custom keyboards can intercept everything you type. Stick with the system keyboard unless you have a specific reason to trust a third-party keyboard.
Step 6: Reset Credentials
Change Passwords from a Clean Device
Change the passwords for all sensitive accounts, including email, banking, social media, and messaging apps. Do this from a clean device, not the compromised one. The spyware may have captured your old passwords, so changing them from the compromised device could expose the new ones too.
Enable Two-Factor Authentication
For every account that supports it, enable two-factor authentication. Use an authenticator app or hardware key, not SMS-based 2FA, because ZeroDayRAT can intercept SMS messages. If you were using SMS-based 2FA, switch to an authenticator app as part of your recovery.
Revoke Active Sessions
For email and social media accounts, revoke all active sessions. This logs out any session the spyware may have established. Most platforms have this option in security settings. For Google, it is in the security dashboard. For Apple, it is in the Apple ID account page.
Contact Your Bank
If you had banking apps or crypto wallets on the compromised device, contact your bank or exchange. Let them know the device was compromised and ask them to review recent activity. If you use hardware wallets for crypto, connect the hardware wallet to a clean device and verify your balances.
Step 7: Full Recovery
Factory Reset (If Needed)
If you cannot fully identify and remove the spyware, or if you want to be certain the device is clean, factory reset. Back up any data you need first, but be careful not to back up the malicious app. On Android, go to Settings > System > Reset. On iOS, go to Settings > General > Transfer or Reset.
Restore Carefully
When restoring from backup, do not restore apps. Restore only personal data like contacts, photos, and documents. Reinstall apps fresh from the Play Store or App Store. This avoids restoring the malicious app along with your data.
Update Everything
After recovery, update the operating system and all apps to the latest versions. Updates often include security patches that close vulnerabilities the spyware may have used. Turn on automatic updates so you stay current.
Re-Secure the Device
Re-enable any security features you may have turned off during recovery, including Play Protect on Android and Lockdown Mode on iOS if you are a high-risk user. Review your app permissions and keep them minimal. For the full checklist, see our mobile spyware checklist.
Frequently Asked Questions
Should I factory reset immediately if I suspect ZeroDayRAT?
No. A factory reset destroys evidence and should not be the first step. First, isolate the device in airplane mode, preserve evidence with screenshots and notes, and identify the malicious app. Factory reset only if you cannot fully identify or remove the spyware.
How do I find ZeroDayRAT on my Android phone?
Check Settings > Accessibility for unknown apps, Settings > Apps > Special access > Notification access for unknown apps, Settings > Security > Device admin apps for unknown apps, and the full app list for apps you did not install. The dangerous permission combination is accessibility plus SMS plus notifications plus location plus camera.
How do I remove ZeroDayRAT from iPhone?
Check Settings > General > VPN and Device Management for configuration profiles you did not install. Remove any MDM enrollment you did not authorize. Delete apps signed with unknown enterprise certificates. Remove custom keyboards you did not install. If in doubt, factory reset and restore only personal data.
Should I change my passwords after ZeroDayRAT infection?
Yes, but from a clean device, not the compromised one. The spyware may have captured your old passwords, so changing them from the compromised device could expose the new ones. Enable two-factor authentication using an authenticator app, not SMS, because ZeroDayRAT can intercept SMS.
Can I recover my data after ZeroDayRAT infection?
Yes, but be careful. Back up personal data like contacts, photos, and documents, but do not back up apps. Factory reset the device, then restore only personal data and reinstall apps fresh from the Play Store or App Store. This avoids restoring the malicious app along with your data.
