---
title: "ZeroDayRAT Incident Response (2026)"
description: "A mobile spyware incident response playbook — isolate, preserve, investigate, remediate, and reset credentials. Practical steps for security teams handling suspected ZeroDayRAT infections."
evidence: "assessment"
last_updated: "2026-08-31"
author: "Daniel Voss, Lead Threat Researcher"
canonical: "https://zerodayrat.shop/incident-response"
---

# ZeroDayRAT Incident Response

**Evidence classification: Analytical Assessment** — This playbook is based on general mobile spyware incident response best practices applied to reported ZeroDayRAT capabilities.

## Overview

When a device is suspected of being compromised by ZeroDayRAT or similar mobile spyware, the incident response process must preserve evidence while containing the threat. The sequence matters: **isolate before you investigate, investigate before you wipe**.

## Phase 1: Isolate

**Goal**: Stop communication with the operator's infrastructure without destroying evidence.

1. Put the device in **airplane mode** immediately. This cuts network access without powering down.
2. Do **not** turn off the device yet — some spyware persists across reboots, and volatile evidence may be lost.
3. Do **not** uninstall apps yet — you need to identify what was installed first.
4. Move to a **clean network** if you need internet access for investigation (new Wi-Fi, not the victim's usual network).

## Phase 2: Preserve

**Goal**: Capture the device state before anything changes.

1. **Screenshot** the home screen, app drawer, and recent apps.
2. **Document** all installed apps — Settings > Apps > see all apps.
3. **Audit permissions** — especially accessibility, notification access, overlay, device admin.
4. **Export** network logs if available (Android: network logs via developer options).
5. **Note** any unusual apps, especially those with no icon or generic names.
6. **Record** the device make, model, OS version, and security patch level.

## Phase 3: Investigate

**Goal**: Identify the spyware and determine scope.

1. **Check accessibility services** — Settings > Accessibility. Look for apps that shouldn't have access.
2. **Check notification access** — Settings > Notification access. Same audit.
3. **Check overlay permissions** — Settings > Display over other apps.
4. **Check device admin apps** — Settings > Device admin apps.
5. **Check sideloaded apps** — Any APK installed from outside the Play Store.
6. **Check MDM profiles** (iOS) — Settings > General > VPN & Device Management.
7. **Correlate with identity telemetry** — Check for MFA anomalies, token usage from unexpected locations, OAuth grants.
8. **Check network logs** — Look for outbound connections to unknown infrastructure.

## Phase 4: Remediate

**Goal**: Remove the spyware and restore the device to a trusted state.

1. **Revoke permissions** from suspicious apps.
2. **Uninstall** the identified spyware app(s).
3. **Remove** any MDM or configuration profiles that you didn't install.
4. **Factory reset** the device if you cannot confidently identify all malicious components. This is the safest option for targeted spyware.
5. **Re-enroll** in MDM with a fresh policy.

## Phase 5: Credential Reset

**Goal**: Assume all credentials, tokens, and sessions on the device are compromised.

1. **Reset passwords** for all accounts accessed from the device — email, banking, social, work.
2. **Revoke active sessions** — Google, Microsoft, Apple, social media, banking apps.
3. **Re-register MFA** — Remove the device from MFA and re-enroll on the clean device.
4. **Revoke OAuth grants** — Check Google Workspace and Microsoft 365 for app consent grants.
5. **Check for forwarding rules** — Email accounts may have auto-forwarding rules set by the attacker.
6. **Reset API tokens** — Any API keys or tokens stored on or accessed from the device.

## FAQ

### Should I factory reset the device?

If you can confidently identify and remove the spyware, a targeted removal may suffice. If you cannot, a factory reset is the safest option. For targeted spyware like ZeroDayRAT, assume the device cannot be trusted until reset.

### What credentials need to be reset?

Everything accessed from the device: email, banking, social media, work accounts, password managers, crypto wallets, and any app that stores session tokens. Revoke all active sessions, not just passwords.

### Should I report the incident?

Yes. Document your findings and share indicators with your ISAC, CERT, or community. If the targeting is related to your work or activism, consider contacting a specialist organization.

## Sources

- [iVerify](https://iverify.com) — ZeroDayRAT mobile research reporting
- [SecurityWeek](https://securityweek.com) — coverage of advertised platform functionality
- [BleepingComputer](https://bleepingcomputer.com) — technical analysis reporting
- [ThaiCERT](https://thaicert.or.th) — advisory summarising reported functionality
- [Dark Reading](https://darkreading.com) — threat landscape analysis