Cheap, low-noise reconnaissance that establishes whether a device is a valuable target and what defences are present. Fleet fingerprinting can reveal patch levels and management posture across a workforce. MDM inventory drift, unexpected device-info reads by non-system apps, new app installs preceding profiling activity.
Capability Matrix
ZeroDayRAT Capabilities
Seventeen reported or advertised capabilities, each with attacker rationale, enterprise implications, defensive telemetry and an evidence classification. Reported is not confirmed; advertised is not demonstrated.
Quick Answer
What can ZeroDayRAT reportedly access?
Reported and advertised ZeroDayRAT functionality covers device and SIM profiling, installed-application intelligence, live location and location history, SMS content, notification previews, account identifiers, camera and microphone access, screen monitoring, input capture, one-time-code exposure, banking and cryptocurrency targeting, clipboard manipulation and remote administration. Several of these are seller claims rather than independently demonstrated behaviour.
Reported — 13 capabilities
Described by credible security researchers but not fully independently verified with published technical evidence. Includes device profiling, location, SMS, notifications, screen capture, keylogging, OTP exposure, clipboard manipulation and remote administration.
Advertised / Claimed — 4 capabilities
Claimed by the seller or operator. No independent technical evidence has been published. Camera surveillance, microphone surveillance, banking credential targeting and cryptocurrency targeting fall here.
Join Our Community
ZeroDayRAT Intelligence on Telegram
Get real-time mobile spyware alerts, threat briefings, and defensive guidance.
Indicates which SMS-based authentication paths and roaming behaviours are available. Useful precursor to SIM-swap style social engineering against staff. Apps requesting telephony state without a functional need; permission-usage logs.
Directs targeting toward the highest-value apps and identifies security tooling worth avoiding. Exposes the corporate app estate on a device, including VPN and MDM agents. Query of installed packages, usage-stats access grants, accessibility-service enrolment.
Supports surveillance, coercion, physical targeting and timing of other attacks. Executive travel and site visits become predictable to an outside party. Background location grants, persistent location-usage indicators, battery drain patterns.
Reveals home, office, family and meeting locations without further collection. Board meetings, M&A site visits and undisclosed facilities can be inferred. Large periodic outbound transfers, location permission combined with background execution.
SMS is still an authentication channel; reading it can undermine account recovery and 2FA. Password resets and SMS-based MFA for corporate services become unreliable. SMS read/receive permissions on non-messaging apps, default-SMS-app changes.
A low-friction route to content from encrypted messengers and authenticator apps. Corporate chat and email previews leak without the app itself being compromised. Notification listener services enabled, unexpected entries in notification-access settings.
Identity is the pivot point from one device to many services. Reveals corporate SSO identities present on a personal device. Accounts permission usage, identity-provider sign-in anomalies.
High-impact intelligence and coercion material. Whiteboards, screens and physical documents can be observed. OS camera-in-use indicators, permission-usage timelines, unexpected foreground services.
Room audio bypasses every messaging control entirely. Board and legal discussions become collectable. Microphone privacy indicators, audio-focus events, sustained upload activity.
Defeats app-level protections by observing the rendered result. Any corporate application viewed on the device is exposed. Screen-capture / projection permission grants, accessibility abuse, unusual media projection services.
Credentials at the moment of entry, before any transport protection applies. Directly threatens SSO and privileged credentials. Accessibility service enrolment, third-party keyboards, input-method changes.
Turns a stolen password into a working session. SMS-based MFA should be treated as compromised on an affected device. Impossible-travel sign-ins, MFA prompts not initiated by the user, new session creation.
Immediate monetisation path. Corporate cards, expense and treasury apps on mobile devices are in scope. Overlay permission grants, accessibility abuse, unexpected app-launch sequences, bank-side anomaly alerts.
Irreversible transactions with no chargeback mechanism. Treasury and custody operations performed on mobile are high risk. Clipboard access events, wallet app crashes or re-auth prompts, on-chain destination mismatch.
Very low technical cost, very high yield against crypto users. Also exposes copied passwords and recovery codes. OS clipboard-access notices, background clipboard reads, user reports of altered pasted values.
Persistence of access is worth more than any single data theft. Long-dwell access to an employee endpoint enables staged escalation. Beaconing intervals, rare-domain resolution, persistent outbound sessions, device-admin privileges.
Evidence & Sources
ZeroDayRAT reporting summarised here draws on public cybersecurity research and CERT-style reporting from February 2026 onward. We distinguish independently observed technical evidence from media reporting, operator claims and our own analytical assessment. Primary sources are linked so readers can verify claims directly.
- iVerify — ZeroDayRAT research — mobile security research, February 2026
- SecurityWeek — ZeroDayRAT coverage — cybersecurity media, February 2026
- BleepingComputer — mobile spyware reporting — cybersecurity media
- ThaiCERT — advisory on reported functionality — CERT advisory, February 2026
- Dark Reading — commercial spyware analysis — cybersecurity media, February 2026
- Cyberthint — seller-demo & HUMINT analysis — threat intelligence/HUMINT, February 2026
- The Hacker News — builder/panel architecture — secondary security press, February 2026
- ESET forum — vendor IOC inquiry — vendor staff statement, February 2026
- Android and Apple platform security documentation — for permission and indicator behaviour.
Source verification policy: see Editorial Policy
Support This Publisher
Related Intelligence
Research Standard
We distinguish independently observed technical evidence from media reporting, vendor claims and analytical assessment. Our objective is to document mobile threats accurately without facilitating unauthorized surveillance. This site publishes no exploit code, payloads or deployment instructions.