The Financial Side of ZeroDayRAT
ZeroDayRAT is often discussed as a surveillance tool, but it also has a financial side. The platform combines the surveillance features of stalkerware with the financial targeting features of banking trojans. This hybrid nature is part of what makes it notable and part of what makes it dangerous. A tool that can track your location and read your messages can also drain your bank account and steal your cryptocurrency.
This deep dive from the ZeroDayRAT Intelligence Center examines the financial threat surface of ZeroDayRAT, how each financial capability works, and how to protect your banking and crypto assets. For the full capability breakdown, see our banking and crypto risk guide.
OTP Interception
How It Works
One-time passwords, or OTPs, are the backbone of two-factor authentication for banking and many other services. When you log in or transfer money, the bank sends a code to your phone via SMS, and you enter it to confirm the action. ZeroDayRAT intercepts these codes using the SMS permission and notification access on Android.
The implant reads incoming SMS messages and notifications, extracts the OTP code, and sends it to the C2. The operator can then use the code to complete a login or transaction on your account, often in real time. This defeats SMS-based two-factor authentication entirely, which is why we recommend authenticator apps or hardware keys over SMS 2FA.
Evidence Classification
OTP interception is Confirmed as a general Android threat technique and Reported as a ZeroDayRAT feature specifically. Multiple researchers have documented the capability in seller demonstrations and controlled testing. The technique itself is well-understood and used by many banking trojans, not just ZeroDayRAT. For more on the broader banking trojan landscape, see our banking trojans analysis.
How to Protect Against It
The most effective protection is to stop using SMS for two-factor authentication. Switch to an authenticator app like Google Authenticator, Microsoft Authenticator, or Authy, or use a hardware key like YubiKey. These methods are not vulnerable to SMS interception. If your bank does not offer authenticator app 2FA, ask them to add it, and in the meantime, be extra cautious about any app you install on your phone.
For high-value accounts, consider passkeys, which are phishing-resistant and do not rely on OTPs at all. Passkeys are supported by Google, Apple, Microsoft, and an increasing number of banks and services.
Clipboard Hijacking
How It Works
When you copy a cryptocurrency wallet address, it goes into the clipboard. You then paste it into the send field of your wallet app to transfer funds. Clipboard hijacking malware monitors the clipboard for patterns that look like cryptocurrency wallet addresses, and when it finds one, it replaces the copied address with an attacker-controlled address.
If you do not notice the switch, you paste the attacker's address and send your funds to them instead of your intended recipient. Because cryptocurrency transactions are irreversible, the funds are gone. This is a devastating attack because the victim does everything correctly, they copied the right address, but the malware changed it between copy and paste.
Evidence Classification
Clipboard hijacking is Confirmed as a general Android threat technique and Reported as a ZeroDayRAT feature. The technique is well-documented across multiple malware families. For a detailed analysis of clipboard hijacking, see our clipboard hijacking blog post.
How to Protect Against It
The most reliable protection is to always verify the pasted address against the original before sending. Do not just copy and paste without looking. Compare the first and last several characters of the address in the send field with the address you intended to send to. If they do not match, you have clipboard hijacking malware.
For larger transactions, send a small test amount first and confirm it arrived before sending the full amount. Use hardware wallets for significant crypto holdings, because hardware wallets display the address on their own screen for confirmation, bypassing the phone's clipboard entirely.
Credential Overlay Attacks
How It Works
Credential overlay attacks use the accessibility service to draw a fake login screen on top of a legitimate app. When you open your banking app, the spyware detects it and immediately overlays a screen that looks identical to the bank's login page. You enter your credentials, the spyware captures them, and then either sends them to the C2 or forwards them to the real login page so you do not notice anything happened.
This is a powerful attack because it defeats even strong passwords. The user thinks they are logging into their bank, but they are actually handing their credentials to the attacker. The accessibility service is what makes this possible, because it can detect when an app opens and draw overlays on top of it.
Evidence Classification
Credential overlay attacks are Reported as a ZeroDayRAT capability. The technique is well-documented across banking trojans like Anatsa, Cerberus, and Hydra. The accessibility service is the enabler, and ZeroDayRAT uses it. For more on how the accessibility service is abused, see our Android accessibility spyware vector analysis.
How to Protect Against It
The best protection is to never grant accessibility access to apps you do not completely trust. Audit your accessibility settings regularly. If you see an app you do not recognize, remove it immediately. For banking specifically, use banks that offer app-based authentication rather than relying on the app alone, and enable biometric authentication where available, because biometrics cannot be captured by an overlay.
For organizations, MDM can restrict accessibility access on managed devices, which eliminates this attack vector for managed fleets. See our enterprise risk guide for the full enterprise approach.
Banking App Targeting
Which Apps Are at Risk
Any banking or financial app on an infected Android device is at risk. The spyware can identify installed banking apps and target them specifically with overlay attacks or credential capture. Crypto wallet apps are also at risk, both for credential theft and clipboard hijacking.
The risk is not limited to obvious financial apps. Payment apps like Cash App, Venmo, and PayPal are also targets. Investment apps like Robinhood and trading platforms are targets. Any app that can move money is a target.
How Attackers Use Captured Credentials
Once the attacker has banking credentials, they can log in from their own device, use the intercepted OTP to complete authentication, and initiate transfers. They may also sell the credentials on dark web markets. The speed of the attack is what makes it dangerous, the window between credential capture and fund transfer can be minutes.
How to Protect Banking Apps
Use authenticator app 2FA instead of SMS. Enable biometric authentication in your banking app. Monitor your accounts regularly for unauthorized transactions and set up transaction alerts. Use a separate clean device for banking if your primary device is higher risk. For the full banking and crypto protection guidance, see our banking and crypto risk guide.
Cryptocurrency Risk
Why Crypto Is Especially Vulnerable
Cryptocurrency is especially vulnerable to ZeroDayRAT and similar spyware because crypto transactions are irreversible. If a bank account is drained, there is often a fraud department that can reverse the transaction. If crypto is sent to the wrong address, it is gone permanently. This makes clipboard hijacking and credential theft particularly devastating for crypto users.
Hardware Wallets
The best protection for significant crypto holdings is a hardware wallet. A hardware wallet stores your private keys on a separate device that is not connected to the internet. When you want to send crypto, you initiate the transaction on your phone or computer, but you confirm it on the hardware wallet by pressing a physical button. The hardware wallet displays the recipient address on its own screen, so you can verify it before confirming, bypassing the phone's clipboard entirely.
Software Wallet Hygiene
If you use a software wallet on your phone, be extra careful. Verify every address before sending. Send test amounts first for large transactions. Keep only what you need for daily use on the phone, and store the rest on a hardware wallet. Do not keep seed phrases on your phone, and never type or paste them into any app.
Frequently Asked Questions
Can ZeroDayRAT steal my banking password?
Yes. ZeroDayRAT can use credential overlay attacks via the accessibility service to capture banking credentials. When you open your banking app, the spyware overlays a fake login screen that looks identical to the real one, and captures your credentials when you enter them.
Can ZeroDayRAT intercept my SMS verification codes?
Yes. ZeroDayRAT uses the SMS permission and notification access to intercept incoming SMS messages, including OTP verification codes. The operator can use the intercepted code to complete logins or transactions on your accounts. This is why authenticator apps or hardware keys are recommended over SMS 2FA.
Can ZeroDayRAT steal my cryptocurrency?
Yes. ZeroDayRAT can use clipboard hijacking to replace cryptocurrency wallet addresses you copy with attacker-controlled addresses. When you paste the address and send, the funds go to the attacker. Because crypto transactions are irreversible, the funds are gone. Always verify pasted addresses before sending.
How do I protect my bank account from ZeroDayRAT?
Use authenticator app 2FA instead of SMS. Enable biometric authentication in your banking app. Monitor your accounts for unauthorized transactions and set up alerts. Use a separate clean device for banking if your primary device is higher risk. Never grant accessibility access to apps you do not completely trust.
Should I use a hardware wallet to protect against ZeroDayRAT?
Yes, for significant crypto holdings. A hardware wallet stores your private keys offline and displays the recipient address on its own screen, bypassing the phone's clipboard entirely. This protects against both clipboard hijacking and credential theft. Keep only what you need for daily use on your phone.
