---
title: "ZeroDayRAT Detection Guide (2026)"
description: "A multi-layer detection framework for ZeroDayRAT mobile spyware — device, behavioral, identity, and network indicators with a triage sequence for security teams."
evidence: "reported"
last_updated: "2026-08-31"
author: "Daniel Voss, Lead Threat Researcher"
canonical: "https://zerodayrat.shop/detection"
---

# ZeroDayRAT Detection Guide

**Evidence classification: Reported** — Detection indicators are based on reported ZeroDayRAT capabilities and general mobile spyware patterns. No live IOCs are published.

## Detection Strategy

Mobile spyware detection requires **cross-layer signal correlation** — no single indicator is sufficient. Static indicator lists (hashes, domains, IPs) are fragile because commercial spyware creates per-operator infrastructure. Instead, defenders should correlate signals across four layers:

1. **Device configuration** — permissions, installed apps, accessibility services
2. **User behavior** — anomalous device usage patterns, battery, data
3. **Identity telemetry** — MFA anomalies, token usage, session patterns
4. **Network activity** — outbound connections, DNS patterns, TLS anomalies

## Device-Level Indicators

| Indicator | What to Check |
|-----------|--------------|
| Accessibility services | Apps with accessibility access that shouldn't have it (not screen readers, not password managers) |
| Notification access | Apps with notification listener access that don't need it |
| Overlay permissions | Apps with "display over other apps" permission |
| Device admin | Apps with device administrator privileges that shouldn't |
| Sideloaded apps | APKs installed from outside the Play Store |
| Hidden apps | Apps with no launcher icon but running in background |
| Unusual permissions | Camera, microphone, location, SMS granted to non-essential apps |

## Behavioral Indicators

| Indicator | What to Check |
|-----------|--------------|
| Battery drain | Unusual battery consumption patterns, especially when idle |
| Data usage | Background data transfers, unexpected traffic volume |
| Temperature | Device running warm when idle (background processing) |
| Behavior changes | Screen turning on by itself, unexpected reboots, delayed response |
| App crashes | Security apps crashing or being disabled (anti-analysis) |

## Identity Telemetry

| Indicator | What to Check |
|-----------|--------------|
| MFA anomalies | Unexpected MFA prompts, MFA fatigue attacks |
| Token usage | Access tokens from unexpected locations or devices |
| Session patterns | Concurrent sessions from different geographies |
| Credential reset | Password changes you didn't initiate |
| OAuth grants | Unexpected app consent grants in Google Workspace or Microsoft 365 |

## Network Indicators

| Indicator | What to Check |
|-----------|--------------|
| Outbound connections | Connections to unknown IPs/domains, especially on non-standard ports |
| DNS patterns | DNS queries to dynamically-generated domains (DGA-like) |
| TLS anomalies | Self-signed certificates, certificate pinning bypasses |
| Traffic timing | Periodic beaconing patterns, regular check-ins |
| Data exfiltration | Large outbound transfers, especially during idle hours |

## Enterprise Detection Stack

| Layer | Tool | What It Detects |
|-------|------|-----------------|
| Endpoint | MTD (Mobile Threat Defense) | Sideloading, accessibility abuse, malicious apps |
| Network | DNS filtering, proxy | C2 domains, known-bad infrastructure |
| Identity | SIEM, UEBA | MFA anomalies, token abuse, impossible travel |
| Cloud | CASB, cloud audit | OAuth grant abuse, data exfiltration |
| Device | MDM compliance | Jailbreak/root, policy violations, app inventory |

## Triage Sequence

1. **Isolate** — Disconnect the device from network (airplane mode). Do not wipe yet.
2. **Preserve** — Capture device state: screenshots, app list, permission audit, network logs.
3. **Investigate** — Check accessibility services, notification access, overlay permissions, sideloaded apps.
4. **Correlate** — Cross-reference device findings with identity and network telemetry.
5. **Remediate** — Remove malicious apps, revoke permissions, reset credentials.
6. **Report** — Document findings. Share indicators with your ISAC or community.

## FAQ

### Can antivirus detect ZeroDayRAT?

Standard mobile antivirus has limited effectiveness against targeted spyware. Mobile Threat Defense (MTD) solutions with behavioral detection are more effective. But the strongest signal is auditing permissions — especially accessibility and notification access.

### What permissions should I audit first?

Check accessibility services first — this is the most abused permission for mobile spyware. Then check notification access, overlay permissions, and apps installed from outside the Play Store.

### How do I check for hidden apps?

On Android: Settings > Apps > see all apps (including system). Look for apps with no icon. On iOS: there is no equivalent — iOS sandboxing prevents hidden apps, but check for MDM profiles and configuration profiles.

## Sources

- [iVerify](https://iverify.com) — ZeroDayRAT mobile research reporting
- [SecurityWeek](https://securityweek.com) — coverage of advertised platform functionality
- [BleepingComputer](https://bleepingcomputer.com) — technical analysis reporting
- [ThaiCERT](https://thaicert.or.th) — advisory summarising reported functionality
- [Dark Reading](https://darkreading.com) — threat landscape analysis