Reference
Mobile Security Glossary
Every definition is written to be short enough to quote and precise enough to use in an incident report.
Join Our Community
ZeroDayRAT Intelligence on Telegram
Get real-time mobile spyware alerts, threat briefings, and defensive guidance.
- ZeroDayRAT
- The name used for a commercially marketed mobile remote-access and surveillance platform publicly documented by security researchers in February 2026. The name does not establish that the platform uses a zero-day vulnerability.
- RAT
- Remote Access Trojan. Malware that gives an operator ongoing remote control and surveillance of an affected device.
- Spyware
- Malware whose purpose is covert observation of a person or device rather than destruction or extortion.
- Stalkerware
- Consumer monitoring software, usually installed with physical device access by someone known to the victim, used for interpersonal surveillance.
- Commercial spyware
- Surveillance capability productised and sold to multiple buyers, typically with a management console and support.
- Mercenary spyware
- High-capability surveillance software associated with licensed, often government-linked customers and documented exploit chains.
- Zero-day
- A vulnerability unknown to or unpatched by the responsible vendor at the time exploitation begins.
- Zero-click
- An attack that succeeds without deliberate user interaction such as tapping a link or opening an attachment.
- One-click
- An attack requiring a single user action, typically opening a link or file.
- Exploit
- Code or input that abuses a specific vulnerability to change a program’s behaviour.
- Exploit chain
- Several exploits combined to progress from initial reach to durable, privileged access.
- RCE
- Remote code execution. Causing code of an attacker’s choosing to run on a remote system.
- Sandbox
- A platform-enforced isolation boundary limiting what an application can access.
- Sandbox escape
- Breaking out of that isolation boundary to reach resources outside the application’s allowance.
- Privilege escalation
- Obtaining rights beyond those originally granted to the running code.
- Persistence
- Mechanisms that keep malicious access available across reboots, updates or application restarts.
- Payload
- The component delivered and executed once initial access has been achieved.
- C2
- Command and control. Infrastructure through which an operator tasks malware and receives collected data.
- Command and control
- See C2. The channel and infrastructure used to direct malware and retrieve results.
- APK
- Android application package — the installable file format for Android applications.
- IPA
- iOS application archive — the installable package format for iOS applications.
- Sideloading
- Installing an application from a source other than the platform’s official distribution channel.
- Accessibility service
- An Android capability that lets an app read on-screen content and act for the user. Legitimate for assistive tools and a common malware abuse target.
- Overlay
- Drawing an interface above another application. A general mobile-malware technique for deceptive prompts.
- Keylogger
- Software that records input, exposing passwords, PINs, recovery phrases and message drafts.
- Screen capture
- Recording or observing rendered screen content, exposing anything the user can see.
- OTP
- One-time password. A short-lived code used as an authentication or recovery factor; exposed if SMS or notifications are readable.
- MFA
- Multi-factor authentication. Requiring more than one factor to authenticate; strength depends heavily on which factors are used.
- SIM
- The subscriber identity module that ties a device to a mobile subscription; its identifiers support profiling and SMS-based attacks.
- MDM
- Mobile Device Management. Enforces configuration, policy and inventory on managed devices. Not a threat detector.
- MTD
- Mobile Threat Defense. Detects malicious or risky applications, configurations and network attacks on mobile devices.
- EDR
- Endpoint Detection and Response. Deep endpoint telemetry and response tooling; mobile coverage is limited by platform APIs.
- Mobile forensics
- The discipline of preserving and analysing mobile device artefacts to establish what happened on a device.
- IOC
- Indicator of compromise. An observable artefact associated with malicious activity, such as a domain or file hash.
- IOA
- Indicator of attack. A behavioural pattern suggesting an attack in progress, independent of specific artefacts.
- TTP
- Tactics, techniques and procedures. The behavioural description of how an actor operates.
- MITRE ATT&CK
- A publicly maintained knowledge base of adversary tactics and techniques, including a mobile matrix used for detection planning.
- Lockdown Mode
- An optional Apple hardened configuration that reduces attack surface for individuals at elevated risk.
- Advanced Protection
- An Android hardened mode that reduces attack surface for high-risk users.
- Conditional access
- Policy that grants access only when device, identity and risk conditions are satisfied.
- Session token
- Credential material representing an authenticated session; if stolen, it can bypass password and MFA prompts.
Support This Publisher