Does ZeroDayRAT need a zero-day vulnerability to work?

No public technical evidence confirms that ZeroDayRAT depends on a genuine, previously unknown vulnerability. The platform name is marketing, not evidence. Reported delivery has centred on user-involved installation — persuading a target to install or approve something — rather than interaction-free exploitation. An advertised "exploit" function in operator material establishes that the seller claims exploitation, not that a working zero-day exists behind it.

How does ZeroDayRAT get on a phone?

Public reporting has focused on social engineering: a target is persuaded to install an application from outside official app stores, or to grant powerful permissions during setup. On Android this centres on sideloaded APKs and accessibility-service or notification access. On iOS, claimed compatibility has been advertised but not independently demonstrated. Zero-click delivery has not been publicly confirmed.

Can I check if I am infected?

No single indicator is reliable. Correlate signals instead: review unknown or sideloaded apps, unexpected accessibility or notification access, unusual permission combinations, battery or data anomalies, and identity events such as unexpected sign-ins or MFA prompts. The Detection Guide and IR Checklist on this site walk through the full triage sequence.

Is the name "ZeroDayRAT" accurate?

The name implies a zero-day exploit, but product naming is marketing. A RAT (remote-access trojan) is defined by remote administration behaviour, not by the exploit used to deliver it. Independent researchers have not publicly confirmed a genuine ZeroDayRAT zero-day or zero-click chain. The evidence classification on this site distinguishes observed, reported, advertised and unconfirmed claims.

Response Playbooks

Mobile Spyware Incident Response

What to do — and in what order — when a phone may be under surveillance. The most common mistake is destroying the evidence before anyone has established what happened.

Analytical AssessmentLast reviewed: 2026-08-31By Daniel Voss, Lead Threat Researcher

Quick Answer

What should I do if I suspect mobile spyware?

Stop using the device for authentication, then reset credentials from a separate known-clean device starting with email and your identity provider. Revoke active sessions and review MFA methods and mailbox forwarding rules. Do not immediately factory reset a high-value device: a reset destroys forensic evidence. Preserve first, investigate, contain identity exposure, then remediate and monitor.

Phase 01
Identify
Confirm what triggered the concern and scope which accounts and data the device can reach.
Phase 02
Isolate
Reduce ongoing access — remove corporate connectivity, revoke sessions, consider network isolation.
Phase 03
Preserve Evidence
For high-value cases, preserve before altering. A reset destroys the record.
Phase 04
Investigate
Correlate device configuration, identity telemetry and network activity across the same window.
Phase 05
Contain Identity Exposure
Revoke tokens, review MFA methods, inspect mailbox rules and OAuth grants.
Phase 06
Remediate
Remove or rebuild the device according to the confidence and value of the case.
Phase 07
Reset Credentials
Rotate from a separate known-clean device, prioritising email and identity provider.
Phase 08
Recover
Restore service with hardened configuration and documented exceptions.
Phase 09
Monitor
Watch identity and network telemetry for a defined post-incident period.

Critical Sequencing

Do not immediately destroy evidence in high-value investigations. Consider forensic preservation. Credential resets should occur from a known-clean device — resetting a password on the compromised handset simply hands over the new one.

Professional Spy Phones — Zero-Click Spyware for authorized investigative and cyber intelligence operations

Playbooks by Affected Party

01Stop using the device for authentication immediately; treat SMS codes on it as exposed.
02From a separate trusted device, change the email password first, then other critical accounts.
03Review and revoke active sessions and connected apps on email, cloud and social accounts.
04Replace SMS-based MFA with an authenticator app or hardware key where offered.
05Review installed apps, profiles, accessibility and notification access on the device.
06Update the operating system, then consider a clean rebuild rather than restoring a suspect backup.
07Watch bank and payment alerts closely for at least 30 days.

Identity Containment Checklist

Review active sessions on email, identity provider, cloud consoles and messaging platforms.
Revoke refresh tokens and force re-authentication where the platform supports it.
Review MFA methods for additions or changes; remove unknown enrolments.
Inspect email forwarding rules, delegate access and inbox rules for silent exfiltration.
Review OAuth application grants and remove anything unrecognised.
Review banking, payment and cryptocurrency activity for the exposure window.
Notify contacts if their data or communications may have been exposed.

Join Our Community

ZeroDayRAT Intelligence on Telegram

Get real-time mobile spyware alerts, threat briefings, and defensive guidance.

Join the Channel

Should the Phone Be Factory Reset?

Eventually, usually yes — but not first. A reset removes most non-persistent mobile malware, which is why it is attractive. It also erases the artefacts an investigator needs to establish what was accessed, for how long, and whether other devices in the organisation share the same exposure. For a consumer with low investigative need, reset early. For an executive, official, journalist or any case with legal implications, preserve first and let a specialist advise.

When to Escalate Externally

Suspected targeting of officials, journalists or civil-society figures.
Evidence of unauthorized surveillance that may constitute a criminal offence.
Financial loss requiring bank, exchange or law-enforcement involvement.
Regulatory or contractual reporting obligations triggered by data exposure.
Any case where internal capability cannot establish scope with confidence.

Contact appropriate cybersecurity or law-enforcement resources when necessary. National CERTs and cybersecurity authorities can advise on reporting obligations and, in some jurisdictions, provide direct assistance.

Evidence & Sources

ZeroDayRAT reporting summarised here draws on public cybersecurity research and CERT-style reporting from February 2026 onward. We distinguish independently observed technical evidence from media reporting, operator claims and our own analytical assessment. Primary sources are linked so readers can verify claims directly.

iVerify — ZeroDayRAT research — mobile security research, February 2026
SecurityWeek — ZeroDayRAT coverage — cybersecurity media, February 2026
BleepingComputer — mobile spyware reporting — cybersecurity media
ThaiCERT — advisory on reported functionality — CERT advisory, February 2026
Dark Reading — commercial spyware analysis — cybersecurity media, February 2026
Cyberthint — seller-demo & HUMINT analysis — threat intelligence/HUMINT, February 2026
The Hacker News — builder/panel architecture — secondary security press, February 2026
ESET forum — vendor IOC inquiry — vendor staff statement, February 2026
Google Android security documentation and Apple Platform Security documentation — for platform control descriptions.
MITRE ATT&CK Mobile knowledge base — for technique framing and detection mapping.

Source verification policy: see Editorial Policy

Support This Publisher

Related Intelligence