What Is ZeroDayRAT?
ZeroDayRAT is the product name used for a commercially marketed mobile surveillance and remote-access trojan (RAT) that surfaced in public security research in February 2026. The name combines "zero-day" with "RAT," but the name itself is a marketing label, not a technical finding. Public evidence does not currently establish that the platform relies on a genuine zero-day exploit or a zero-click delivery mechanism. Naming is not evidence, and this distinction matters for anyone trying to understand what the threat actually does versus what the seller claims it does.
According to analysis by the ZeroDayRAT Intelligence Center and corroborating researchers at iVerify, ThaiCERT, and Cyberthint, the platform is sold as a malware-as-a-service product through Telegram channels and dark web forums. It targets both Android and iOS devices, though the Android version has been more extensively documented. Reported capabilities include location tracking, SMS and notification interception, camera and microphone access, screen capture, keylogging, and financial targeting through OTP interception and clipboard manipulation.
The Evidence Problem With ZeroDayRAT
One of the first things a careful researcher notices about ZeroDayRAT is the gap between advertised and verified capabilities. The seller's promotional materials list an extensive feature set, but independent analysis has only confirmed a subset of those claims. At the ZeroDayRAT Intelligence Center, we classify every claim with an explicit evidence level: Observed, Confirmed, Reported, Advertised, or Unconfirmed. This matters because defenders who build detection around advertised capabilities may waste effort on features that do not actually exist in the wild.
For a deeper look at our classification methodology, see our evidence classification system and the editorial policy that governs how we attribute findings.
Architecture: Builder, Panel, and Implant
ZeroDayRAT follows a fairly standard commercial RAT architecture with three main components.
The Builder
The builder is a desktop application that the operator uses to generate the malicious payload. It allows configuration of the C2 server address, persistence options, payload encryption, and target-specific settings. The builder itself does not need to be sophisticated, what matters is the payload it produces. Based on seller screenshots and researcher analysis, the builder appears to run on Windows and produces APK packages for Android targets.
The Command and Control Panel
The C2 panel is a web-based dashboard where the operator monitors infected devices, sends commands, and views exfiltrated data. Screenshots shared by Cyberthint show a dashboard with device lists, capability toggles, and real-time data feeds. The panel handles multiple victims simultaneously, which is typical of commercial spyware. The panel's existence is Advertised (seen in seller demos), and its functionality is Reported by researchers who analyzed the seller's promotional videos.
The Mobile Implant
The implant is the application that runs on the victim's device. On Android, it typically requests a broad set of permissions including accessibility, SMS, location, camera, microphone, and notifications. On iOS, the delivery path is less clear, with some reports suggesting MDM profile abuse or enterprise certificate signing, but these claims remain Unconfirmed. The implant communicates with the C2 over HTTP or WebSocket connections, often with basic encryption.
Reported Capabilities: What ZeroDayRAT Actually Does
The following capabilities have been Reported or Confirmed by independent researchers. I am deliberately separating these from the advertised feature list.
Location Tracking
GPS and network-based location reporting is Confirmed across multiple analyses. The implant periodically sends coordinates to the C2, and the operator can request on-demand updates. This is one of the most basic and most reliable capabilities.
SMS and Notification Interception
The implant uses Android's SMS permission and notification access to intercept incoming messages, including OTP codes. This is Confirmed and is the basis for the financial targeting features. On iOS, notification interception is less straightforward and remains Reported but not independently verified.
Camera and Microphone Access
Camera and microphone capture is Advertised prominently in seller materials. Independent confirmation is limited. Some researchers have Reported observing audio capture in controlled tests, but full camera surveillance has not been independently verified in the wild. We classify this as Advertised with partial Reported confirmation.
Screen Capture and Keylogging
Screen capture via the MediaProjection API and keylogging via the Accessibility Service are Reported capabilities. The accessibility service is the workhorse of Android spyware, it enables overlay attacks, keylogging, and interaction hijacking. For a detailed comparison of how these permissions map to capabilities, see our capability-to-permission map.
Financial Targeting
OTP interception, clipboard manipulation for cryptocurrency theft, and banking credential overlay attacks are all Reported. The clipboard hijacking in particular is a well-understood technique, the implant monitors the clipboard for patterns that look like cryptocurrency wallet addresses and replaces them with attacker-controlled addresses. This is Confirmed as a general Android threat technique and Reported as a ZeroDayRAT feature specifically.
What Is NOT Verified
I want to be explicit about what the public evidence does not support.
Zero-Click Exploitation
Despite the name, there is no public evidence that ZeroDayRAT uses a zero-click exploit. All documented delivery paths require some form of user interaction, typically sideloading an APK or granting permissions. The name is a marketing choice, not a technical description. For more on this distinction, see our analysis of zero-day versus zero-click versus RAT terminology.
iOS Full Surveillance
The iOS version is advertised with the same capabilities as Android, but the technical constraints of iOS make many of these claims implausible without a jailbreak or MDM enrollment. Apple's sandboxing, code signing, and permission model make silent camera and microphone access extremely difficult. We classify most iOS capability claims as Advertised and Unconfirmed.
Nation-State Attribution
ZeroDayRAT is a commercial product, not a nation-state tool. It is sold to multiple buyers, and attribution to any specific government is not supported by public evidence. Conflating commercial spyware with mercenary spyware like Pegasus is a category error. See our ZeroDayRAT vs Pegasus comparison for the full breakdown.
How ZeroDayRAT Compares to Other Threats
ZeroDayRAT sits in an awkward space between stalkerware and banking trojans. It has the surveillance features of stalkerware (location, camera, microphone, messages) and the financial features of banking trojans (OTP interception, clipboard hijacking, credential overlay). This hybrid nature is part of what makes it notable. For the full taxonomy, see our ZeroDayRAT vs Stalkerware analysis.
The commoditization trend is real. Products like ZeroDayRAT represent a lowering of the barrier to entry for mobile surveillance. Where mercenary spyware costs hundreds of thousands of dollars per target, commercial RATs like ZeroDayRAT are sold for a fraction of that, making surveillance accessible to a much wider audience. Our commercial spyware economy analysis covers this trend in detail.
Detection and Defensive Guidance
If you are trying to detect ZeroDayRAT or similar commercial RATs, the most reliable indicators are behavioral, not signature-based. Look for apps requesting dangerous permission combinations (accessibility plus SMS plus notifications), unexpected network connections to unknown servers, unusual battery or data usage, and apps installed from outside official stores. Our detection guide and technical report provide specific YARA, Sigma, and KQL rules.
For incident response, the most important rule is do not factory reset immediately if you want to preserve evidence. Isolate the device, document everything, and reset credentials from a separate clean device. Our incident response playbook walks through the full process.
Frequently Asked Questions
Is ZeroDayRAT a real threat?
Yes. ZeroDayRAT is a real commercial mobile spyware product documented by multiple security researchers in 2026. However, some advertised capabilities are not independently verified, and the name does not mean it uses zero-day exploits.
Does ZeroDayRAT use zero-click exploits?
No public evidence supports zero-click exploitation. All documented delivery paths require user interaction, typically sideloading an APK or granting permissions. The name is a marketing label, not a technical finding.
Can ZeroDayRAT infect iPhone?
An iOS version is advertised, but most iOS capability claims are unconfirmed. iOS sandboxing and permission controls make silent surveillance difficult without jailbreak or MDM enrollment.
How is ZeroDayRAT different from Pegasus?
ZeroDayRAT is a commercial product sold to many buyers, while Pegasus is mercenary spyware sold to governments. ZeroDayRAT is cheaper, less sophisticated, and does not use zero-click exploits. Pegasus is in a different threat category entirely.
How do I detect ZeroDayRAT?
Look for apps with dangerous permission combinations (accessibility plus SMS plus notifications), unexpected network connections, and apps installed from outside official stores. Behavioral detection is more reliable than signature-based detection.
